Security readout for executives and security teams
Plain-English summary
This issue affects systems that install or use selenium-wrapper. Because it fetches browser-related binaries without transport encryption, someone positioned on the network could replace the download with malicious software. The sources do not show known exploitation or a confirmed patch.
Executive priority
Prioritize remediation for CI, release engineering, and developer systems because compromise there can affect downstream software. Urgency is moderate without evidence of exploitation, but the potential impact is serious.
Technical view
The selenium-wrapper Node module downloads binary resources over plain HTTP. If a network attacker or intermediary can alter traffic, they may substitute a requested binary with attacker-controlled code, causing possible RCE when that binary is used. The bundle lists all versions as affected and maps to CWE-311.
Likely exposure
Exposure is likely in Node.js projects, CI jobs, or developer workstations that depend on the selenium-wrapper package. The source bundle says all versions are affected.
Exploitation context
The sources describe a man-in-the-middle condition: an attacker must be on the network path or between the user and remote server. The CVE is not listed as KEV, and no cited source confirms active exploitation.
Researcher notes
Evidence is limited to the CVE description and Node Security advisory reference. No CVSS, exploit telemetry, or patch details are provided in the bundle. Analysis should avoid expanding affected scope beyond the selenium-wrapper Node module.
Mitigation direction
- Inventory projects and build pipelines for selenium-wrapper usage.
- Remove or replace selenium-wrapper where feasible.
- Check vendor or package advisory guidance before assuming a fixed version exists.
- Avoid installing the package on untrusted networks.
- Use dependency policy controls to block affected versions.
Validation and detection
- Search dependency manifests and lockfiles for selenium-wrapper.
- Review CI images and build scripts for transient package installation.
- Confirm whether installations fetch binary resources during build or setup.
- Check advisory sources for updated remediation guidance.
- Document any systems where package removal is not immediately possible.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-311: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2016-10628 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://nodesecurity.io/advisories/224CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.