CVE-2016-10666: Insecure Download of Executable in tomita-parser
Summary
CVE-2016-10666: Downloads Resources over HTTP in tomita-parser. Affects tomita-parser versions < 0.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tomita-parser is an npm package used for parsing natural language text. It provides functionality for extracting information from text using custom grammars. The package has not been updated since 2015 and is vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The affected versions of tomita-parser insecurely download an executable over an unencrypted HTTP connection. This vulnerability allows an attacker with a privileged network position to intercept the response and replace the executable with a malicious one. As a result, the attacker can execute arbitrary code on the system running tomita-parser. The risk of exploitation is higher when connected to a public network, but even on a private network, attackers who have compromised the network or have privileged access to the ISP can exploit this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The tomita-parser package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. It is recommended to avoid using this package and consider using an alternative. There is currently no patch available for this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tomita-parser →
FAQ
tomita-parser is an npm package used for parsing natural language text. It provides functionality for extracting information from text using custom grammars.
This vulnerability allows an attacker to replace the downloaded executable with a malicious one, leading to code execution on the system running tomita-parser.
No, there is currently no patch available for this vulnerability.
The package has not been updated since 2015.
The best mitigation is to avoid using tomita-parser and consider using an alternative package. If tomita-parser is installed on a private network, ensure that it is not installed while connected to a public network.
