Skip to content
OpenAdvisories
High CVE-2016-10619 EUVD-2019-0360GHSA-x3j8-g4v9-67jq

Downloads Resources over HTTP in pennyworth

Published Jun 1, 2018 · Updated Sep 17, 2024 · Assigned by hackerone

Vendor: HackerOne Product: pennyworth node module Package: pennyworth Ecosystem: npm

Description

pennyworth is a natural language templating engine. pennyworth downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.

Affected products

VendorProductAffectedFixed
HackerOne pennyworth node module All versions —

Affected packages

EcosystemPackageAffectedFixedRecord
npm pennyworth <= 1.0.1 — GHSA-x3j8-g4v9-67jq

References