Description
In [email protected], network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack.
Recommendation
Update the dectalk-tts package to the latest compatible version. Followings are version details:
- Affected version(s): = 1.0.0
- Patched version(s): 1.0.1
References
Could your website be exposed too?
SmartScanner can check your website for dectalk-tts Uses Unencrypted HTTP Request and gives you actionable findings to investigate.
Start a free scanRelated Issues
- evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API - CVE-2025-67427
- Server-Side Request Forgery in axios - CVE-2024-39338
- Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access - CVE-2026-31829
- RSSHub vulnerable to Server-Side Request Forgery - CVE-2024-27927
You might also like:
See something that needs correcting? Let us knowUpdated April 05, 2024