CVE-2016-10534

5.9 mediumEPSS 0.9%

electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--strict-ssl` command line option in electron-packager >= 5.2.1 <= 6.0.0 || >=6.0.0 <= 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a man in the middle attack.

Severity

CVSS 3.0

5.9 medium

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
CWE: CWE-295
Published: 2018-05-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

electron-packager_project:electron-packager

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-q43m-ffwr-rpcc	npm	electron-packager	>=5.2.1 <7.0.0	7.0.0

References

https://github.com/electron-userland/electron-packager/issues/333
https://nodesecurity.io/advisories/104
https://github.com/electron-userland/electron-packager/issues/333
https://nodesecurity.io/advisories/104

Check your stack JSON