Executive brief
bionode-sra is a Node.js wrapper for managing genomic data downloads from NCBI's Sequence Read Archive (SRA). The package downloads resources over unencrypted HTTP instead of HTTPS, allowing attackers on the network path to intercept, read, or modify downloaded data. In the worst case, this could enable remote code execution if an attacker injects malicious content during download.
Technical details
bionode-sra uses HTTP instead of HTTPS to download remote resources, a vulnerability tracked as CWE-269 (improper restriction) and CWE-311 (missing encryption). An attacker with network-level access (adjacent network position, ISP access, or BGP hijacking) can perform man-in-the-middle attacks to intercept or modify downloads. No authentication is required—exploitation occurs automatically during normal package operation. The impact ranges from data theft to remote code execution depending on the nature of the downloaded content and how the package processes it. No patch has been released; the vendor recommends switching to alternative packages like urllib-sync.
Affected products
- bionode bionode-sra all versions through 2.0.0
Timeline
- 2019-02-18: disclosed: Advisory published
- 2026-05-18: other: Repository archived and marked read-only