Executive brief
The unicode JavaScript library downloads required resources over unencrypted HTTP instead of secure HTTPS. An attacker positioned on the network path can intercept and modify these downloads, potentially injecting malicious code or stealing sensitive data during the library's operation.
Technical details
The vulnerability is a missing encryption issue (CWE-311) where the unicode package insecurely downloads resources over HTTP. This allows an attacker with network-level access (man-in-the-middle position) to read or modify transmitted resources. The attack requires no authentication or user interaction—it occurs automatically when the library downloads its resources. Depending on what resources are fetched and how the library uses them, an attacker can achieve information disclosure or remote code execution. The fix is to upgrade to version 9.0.0 or later, which switches to secure HTTPS downloads.
Affected products
- npm unicode < 9.0.0
Timeline
- 2019-02-18: disclosed