Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

translate

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3npmAmendedPublished

    Cache Poisoning Vulnerability

    CVE-2024-29042 · GHSA-882j-4vj5-7vmj

    Affected
    • npm translate < 3.0.0
    Fixed in
    3.0.0· Vendor fix available
    Issue
    An attacker controlling the second variable of the translate function is able to perform a cache poisoning attack. They can change the outcome of translation requests made by subsequent users. Details The opt.id parameter allows the overwriting of the cache key. If an attacker sets the id variable to the cache key that would be generated by another user, they can choose the response that user gets served. PoC Take the following simple server allowing users to supply text and the language to translate to. We can send the following request to poison the cache: Now, any user that attempts to translate "I love you" to Dutch, will get "I hate you" in Dutch as the response. Impact An attacker can control the results other users may get

    Recommended action: Upgrade to 3.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →