Executive brief
mystem is a Node.js package that downloads an executable component over unencrypted HTTP during installation. An attacker positioned on the network path (e.g., on a public WiFi network or compromised ISP) can intercept and replace the executable with malicious code, achieving arbitrary code execution on the developer's or user's machine during package installation.
Technical details
The vulnerability stems from mystem's use of unencrypted HTTP (rather than HTTPS) to download executable resources, a missing encryption issue (CWE-311). The package downloads an executable during installation over an unencrypted HTTP connection without integrity verification. An attacker with network-level access (man-in-the-middle position) can intercept the HTTP response and inject a malicious executable. Attack complexity is high because the attacker must be positioned on the network path during the specific installation window. No patch has been released; the vendor recommends avoiding the package or using it only on private networks where network access is controlled.
Affected products
- npm mystem 0.0.3 and earlier
Timeline
- 2016: disclosed: CVE-2016-10664 assigned
- 2019-02-18: advisory: GHSA-wx3q-6x7x-jjw4 published in GitHub Advisory Database