Skip to content
OpenAdvisories
High CVE-2016-10610 EUVD-2019-0305GHSA-hw4r-xr38-hm8j

Downloads Resources over HTTP in unicode-json

Published Jun 1, 2018 · Updated Sep 17, 2024 · Assigned by hackerone

Vendor: HackerOne Product: unicode-json node module Package: unicode-json Ecosystem: npm

Description

unicode-json is a unicode lookup table. unicode-json before 2.0.0 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.

Affected products

VendorProductAffectedFixed
HackerOne unicode-json node module < 2.0.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm unicode-json < 2.0.0 2.0.0 GHSA-hw4r-xr38-hm8j

References