Loading HuntDB...

GHSA-gc6c-5v9w-xmhw

GitHub Security Advisory

Downloads Resources over HTTP in nodewebkit

✓ GitHub Reviewed HIGH Has CVE

Advisory Details

Affected versions of `nodewebkit` insecurely download an executable over an unencrypted HTTP connection.

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `nodewebkit`.

## Recommendation

No patch is currently available, and the package author has deprecated this package.

The best path forward in mitigating this vulnerability is to use the [official installer](https://www.npmjs.com/nw) instead of this package, as per the package author's instructions.

Affected Packages

npm nodewebkit
Affected versions: 0 (last affected: 0.11.6)

Related CVEs

Key Information

GHSA ID
GHSA-gc6c-5v9w-xmhw
Published
February 18, 2019 11:51 PM
Last Modified
January 8, 2021 6:48 PM
CVSS Score
7.5 /10
Primary Ecosystem
npm
Primary Package
nodewebkit
GitHub Reviewed
✓ Yes

Dataset

Last updated: July 4, 2025 6:27 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.