High CVE-2016-10596 EUVD-2019-0317GHSA-mm7h-323r-9p4g

Downloads Resources over HTTP in imageoptim

Published Jun 1, 2018 · Updated Sep 17, 2024 · Assigned by hackerone

Vendor: HackerOne Product: imageoptim node module Package: imageoptim Ecosystem: npm

Description

imageoptim is a Node.js wrapper for some images compression algorithms. imageoptim downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested tarball with an attacker controlled tarball if the attacker is on the network or positioned in between the user and the remote server.

Affected products

Vendor	Product	Affected	Fixed
HackerOne	imageoptim node module	All versions	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	imageoptim	<= 0.5.0	—	GHSA-mm7h-323r-9p4g

References

https://nodesecurity.io/advisories/194