Affected versions of the console-io package do not configure the underlying websocket library to require authentication, resulting in an authentication bypass vulnerability. As console-io allows terminal access on the server via a web page, an authentication bypass is essentially remote code execution.

Recommendation

Update to version 2.3.0 or later.

References

• https://nvd.nist.gov/vuln/detail/CVE-2016-10532
• GHSA-q52j-4q2q-hcj6
• https://www.npmjs.com/advisories/90