CVE-2016-10585

CVE-2016-10585 affects libxl, a Node.js library for Excel spreadsheet manipulation, due to its insecure practice of downloading zipped resources over unencrypted HTTP. This vulnerability allows for Man-in-the-Middle (MITM) attacks, potentially leading to remote code execution (RCE) if an attacker intercepts and replaces the legitimate zip file. With a CVSS score of 8.1 (High), the attack vector is network-based with high impact on confidentiality, integrity, and availability, though it requires high attack complexity. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.