Downloads Resources over HTTP in strider-sauce
Affected versions of strider-sauce insecurely download an executable over an unencrypted HTTP connection.
In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running strider-sauce.
Recommendation
While the package author has created a patch for this vulnerability, they have not yet published it to npm or bumped the version number.
In order to resolve the vulnerability, you will need to install the module manually from github:
npm install github:Strider-CD/strider-sauce#5ff6d65As this vulnerability does not have a version bump included with the patch, it is possible that you have received a report for a vulnerable package, yet have installed the patched version and are no longer vulnerable. If that is the case, this advisory can be disregarded.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | strider-sauce | <= 0.6.2 | no fix |
References
- CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-311- Platform
- npm
- Package
strider-sauce- Disclosed
- 18.02.2019
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-8gf4-pcj6-54rp - CC BY 4.0
Vulnerability history: strider-sauce
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.