org.webjars.npm:google-translate-api-browser@1.1.521 vulnerabilities

  • latest version

    1.1.521

  • first published

    2 years ago

  • latest version published

    2 years ago

  • licenses detected

  • package manager

  • Direct Vulnerabilities

    Known vulnerabilities in the org.webjars.npm:google-translate-api-browser package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • L
    Server-Side Request Forgery (SSRF)

    org.webjars.npm:google-translate-api-browser is an A free and unlimited API for Google Translate that works in browser

    Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) when input to translateOptions is accepted from the end user. An attacker can manipulate the tld field, causing the application to generate unsafe URLs that point to local resources. This is due to the translateOptions.tld field not being properly sanitized before being included in the Google translate URL. An attacker with control over the translateOptions can set the tld to a payload such as @127.0.0.1, which results in the full URL becoming https://translate.google.@127.0.0.1/..., where translate.google. is the username used to connect to localhost. This allows the attacker to send requests within internal networks and the local host. If there is an HTTPS application on the internal network with a vulnerability that can be exploited via a GET call, it could be exploited using this vulnerability.

    How to fix Server-Side Request Forgery (SSRF)?

    There is no fixed version for org.webjars.npm:google-translate-api-browser.

    [0,)