CVE-2016-10690: Insecure Download of Executable in openframe-ascii-image
Summary
CVE-2016-10690: openframe-ascii-image downloads Resources over HTTP. Affects openframe-ascii-image versions < 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
openframe-ascii-image is an npm package that allows users to display ASCII art images in an openframe environment. It provides functionality to download and display ASCII images. However, versions of openframe-ascii-image prior to 0.1.0 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in openframe-ascii-image arises from the insecure download of an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could result in code execution on the system running openframe-ascii-image. The impact of this vulnerability is significant as it allows an attacker to compromise the integrity and security of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the recommended workaround is to avoid using the openframe-ascii-image package. If you still need to use ASCII art images in an openframe environment, consider using a different package that does not have this vulnerability.
Conclusion
The openframe-ascii-image package has a vulnerability that allows for the insecure download of an executable. To mitigate the risk, it is recommended to avoid using this package and opt for an alternative. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openframe-ascii-image →
FAQ
openframe-ascii-image is an npm package that allows users to display ASCII art images in an openframe environment.
The vulnerability allows an attacker to intercept the download of an executable and replace it with a malicious one, potentially leading to code execution on the system running openframe-ascii-image.
No, currently there is no patch available for this vulnerability.
To mitigate the risk, avoid using the openframe-ascii-image package and use an alternative package if possible. If the package is installed on a private network, the risk is limited to those who have compromised the network or have privileged access to the ISP.
Yes, you can use alternative packages that do not have this vulnerability to display ASCII art images in an openframe environment.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
