GHSA-gc6c-5v9w-xmhw
GitHub Security Advisory
Downloads Resources over HTTP in nodewebkit
Advisory Details
Affected versions of `nodewebkit` insecurely download an executable over an unencrypted HTTP connection.
In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `nodewebkit`.
## Recommendation
No patch is currently available, and the package author has deprecated this package.
The best path forward in mitigating this vulnerability is to use the [official installer](https://www.npmjs.com/nw) instead of this package, as per the package author's instructions.
Affected Packages
Related CVEs
Key Information
Dataset
Data from GitHub Advisory Database. This information is provided for research and educational purposes.