GHSA-3627-w2qr-5fxrHighCVSS 8.1
fuseki downloads Resources over HTTP
🔗 CVE IDs covered (1)
📋 Description
Affected versions of fuseki insecurely download an executable over an unencrypted HTTP connection.
In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running fuseki.
Recommendation
Update to version 1.0.1 or later.
🎯 Affected products1
- npm/fuseki:< 1.0.1