Detections
Analytics

SCA: security update for google-translate-api-browser (GHSA-4233-7q5q-m7p6)

low Tenable Cloud Security Plugin ID 409802

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - google-translate-api-browser is an npm package which interfaces with the google translate web api. A
 Server-Side Request Forgery (SSRF) Vulnerability is present in applications utilizing the `google-
 translate-api-browser` package and exposing the `translateOptions` to the end user. An attacker can set a
 malicious `tld`, causing the application to return unsafe URLs pointing towards local resources. The
 `translateOptions.tld` field is not properly sanitized before being placed in the Google translate URL.
 This can allow an attacker with control over the `translateOptions` to set the `tld` to a payload such as
 `@127.0.0.1`. This causes the full URL to become `https://[email protected]/...`, where
 `translate.google.` is the username used to connect to localhost. An attacker can send requests within
 internal networks and the local host. Should any HTTPS application be present on the internal network with
 a vulnerability exploitable via a GET call, then it would be possible to exploit this using this
 vulnerability. This issue has been addressed in release version 4.1.3. Users are advised to upgrade. There
 are no known workarounds for this vulnerability. (CVE-2023-48711)

See Also

https://github.com/advisories/GHSA-4233-7q5q-m7p6

Plugin Details

Severity: Low

ID: 409802

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 2

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2023-48711

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.4

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/27/2023

Vulnerability Publication Date: 11/24/2023

Reference Information

CVE: CVE-2023-48711

cwe: CWE-918