https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 08:10:21 +0000 https://cve.radiocsirt.org/vuln/cnvd-2018-11275 cnvd-2018-11275 https://cve.radiocsirt.org/vuln/cnvd-2018-11275 https://cve.radiocsirt.org/vuln/euvd-2026-182332 EUVD-2026-182332 https://cve.radiocsirt.org/vuln/euvd-2026-182332 https://cve.radiocsirt.org/vuln/fkie_cve-2016-10534 <p>electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--strict-ssl` command line option in electron-packager &gt;= 5.2.1 &lt;= 6.0.0 || &gt;=6.0.0 &lt;= 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a man in the middle attack.</p> <p>electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--strict-ssl` command line option in electron-packager &gt;= 5.2.1 &lt;= 6.0.0 || &gt;=6.0.0 &lt;= 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a man in the middle attack.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2016-10534 https://cve.radiocsirt.org/vuln/ghsa-q43m-ffwr-rpcc <p><strong>Affected:</strong> npm: electron-packager</p> <p>Affected versions of `electron-packager` configure the generated application to disable SSL certificate verification by default.</p> <p>This could allow an attacker with a privileged network position to launch a Man In The Middle (MITM) attack on the install process, intercepting the step where electron-packager downloads Electron for supported target platforms and architectures, and replacing the valid download with a tampered malicious one.</p> <p>This only affects users using the electron-packager CLI. The strict-ssl option defaults to true for the node.js API.</p> <p>## Recommendation</p> <p>1. Update to version 7.0.0 or later. 2. Delete the `electron-download` cache folder, which is by default located at `~/.electron`.</p> <p><strong>Affected:</strong> npm: electron-packager</p> <p>Affected versions of `electron-packager` configure the generated application to disable SSL certificate verification by default.</p> <p>This could allow an attacker with a privileged network position to launch a Man In The Middle (MITM) attack on the install process, intercepting the step where electron-packager downloads Electron for supported target platforms and architectures, and replacing the valid download with a tampered malicious one.</p> <p>This only affects users using the electron-packager CLI. The strict-ssl option defaults to true for the node.js API.</p> <p>## Recommendation</p> <p>1. Update to version 7.0.0 or later. 2. Delete the `electron-download` cache folder, which is by default located at `~/.electron`.</p> https://cve.radiocsirt.org/vuln/ghsa-q43m-ffwr-rpcc https://cve.radiocsirt.org/vuln/gsd-2016-10534 gsd-2016-10534 https://cve.radiocsirt.org/vuln/gsd-2016-10534