CVE-2016-10698: Insecure Download of Executable in mystem-fix
Summary
CVE-2016-10698: Downloads Resources over HTTP in mystem-fix. Affects mystem-fix versions < 0.0.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mystem-fix is an npm package that provides functionality for fixing the Russian lemmatizer tool called Mystem. It is commonly used in natural language processing applications. However, versions of mystem-fix prior to 0.0.6 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in mystem-fix arises from the insecure download of an executable file. When the package is installed, it attempts to download an executable file over an unencrypted HTTP connection. This poses a risk in scenarios where an attacker has a privileged network position. They can intercept the response and replace the executable with a malicious one. If successful, this could lead to code execution on the system running mystem-fix. The vulnerability has a high severity rating (CWE-311).
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the recommended workaround is to uninstall the mystem-fix package and use an alternative package that provides similar functionality. This can be achieved by running the following command: npm uninstall mystem-fix
Conclusion
The mystem-fix package has a vulnerability that allows for the insecure download of an executable file. This can be exploited by an attacker with a privileged network position to execute malicious code on the system. Currently, there is no patch available, so the best course of action is to uninstall the package and use an alternative. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mystem-fix →
FAQ
mystem-fix is an npm package used for fixing the Russian lemmatizer tool called Mystem. It is commonly used in natural language processing applications.
The vulnerability allows an attacker with a privileged network position to intercept the download of an executable file and replace it with a malicious one. This could result in code execution on the system running mystem-fix.
No, there is currently no patch available for this vulnerability.
To mitigate the risk, it is recommended to avoid using the mystem-fix package and uninstall it if already installed. Additionally, ensure that the package is not installed while connected to a public network.
Yes, it is recommended to use an alternative package that provides similar functionality to mystem-fix.
