CVE-2016-10571: Insecure Download of Resources in bkjs-wand
Summary
CVE-2016-10571: Downloads Resources over HTTP in bkjs-wand. Affects bkjs-wand versions < 0.3.2. Fixed in 0.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
bkjs-wand is an npm package that provides functionality for downloading and managing resources. It is susceptible to an insecure download vulnerability, where an executable is downloaded over an unencrypted HTTP connection. This vulnerability allows an attacker with privileged network position to intercept the response and replace the executable with a malicious one, potentially leading to code execution on the system running bkjs-wand.
Vulnerability Detail
The insecure download vulnerability in bkjs-wand arises from the insecure retrieval of an executable over an unencrypted HTTP connection. This can be exploited by an attacker who can intercept the response and replace the executable with a malicious one. The impact of this vulnerability is significant as it can result in arbitrary code execution on the affected system. The vulnerability has been assigned the identifier CVE-2016-10571.
How To Fix
Latest published version: 0.5.3 as of 22 Oct 2026
npm install bkjs-wand@0.5.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.2
This is the first release that contains the fix.
npm install bkjs-wand@0.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The insecure download vulnerability in bkjs-wand can be mitigated by updating to version 0.3.2 or later. This update ensures that the executable is downloaded over a secure HTTPS connection, reducing the risk of interception and tampering. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bkjs-wand →
FAQ
The vulnerability allows an attacker to replace the downloaded executable with a malicious one, potentially leading to arbitrary code execution on the system running bkjs-wand.
Updating bkjs-wand to version 0.3.2 or later ensures that the executable is downloaded over a secure HTTPS connection, reducing the risk of interception and tampering.
There are no known public exploits for this vulnerability at the time of this report.
Yes, this vulnerability can be exploited remotely by an attacker with a privileged network position.
There is no known workaround for this vulnerability. It is recommended to update bkjs-wand to the latest version.
