Looks like someone already wrote a post about it: https://blog.filippo.io/komodia-superfish-ssl-validation-is-...

I hope to have a write-up at some point in the near future. I'm working with the vendor now to fix the vulnerability and hope they will be agreeable to a co-authored write-up once they've issued patches.