CVE-2016-10640

CVE-2016-10640 describes a critical vulnerability in the node-thulac library, a Node.js binding for the THULAC Chinese lexical analyzer, specifically affecting geohey node-thulac. The vulnerability stems from the library downloading binary resources over unencrypted HTTP, making it susceptible to Man-in-the-Middle (MITM) attacks. An attacker could exploit this by intercepting and replacing the legitimate binary with a malicious one, potentially leading to remote code execution (RCE) with high impact on confidentiality, integrity, and availability. While rated with a CVSS score of 8.1 (High), there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.