CVE-2017-16040

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-311CWE-319

Affected software

VendorProductVersions
HackerOnegfe-sass node moduleAll versions

References

Timeline

Published
Jun 4, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-160415.9ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks.CVE-2017-160429.8Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing foCVE-2017-160436.1Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will rCVE-2017-160447.5`d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160457.5`jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160467.5`mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160477.5mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160487.5`node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160497.5`nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160507.5`sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160517.5`sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160527.5`node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16040: High severity, CVSS 8.1 | Vulnix