Skip to content
OpenAdvisories
High CVE-2016-10597 EUVD-2019-0343GHSA-rwvj-jgc4-fqq5

Downloads Resources over HTTP in cobalt-cli

Published Jun 1, 2018 · Updated Sep 17, 2024 · Assigned by hackerone

Vendor: HackerOne Product: cobalt-cli node module Package: cobalt-cli Ecosystem: npm

Description

cobalt-cli downloads resources over HTTP, which leaves it vulnerable to MITM attacks.

Affected products

VendorProductAffectedFixed
HackerOne cobalt-cli node module All versions —

Affected packages

EcosystemPackageAffectedFixedRecord
npm cobalt-cli <= 2.5.8 — GHSA-rwvj-jgc4-fqq5

References