PT-2024-18942 · Unknown · Node-Gettext

Miguel Coimbra · Published 2024-09-09 · Updated 2024-09-10 · CVE-2024-21528

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions node-gettext versions all

Description The issue is related to Prototype Pollution via the addTranslations() function in gettext.js due to improper user input sanitization. This affects the node-gettext package.

Recommendations For all versions, consider disabling the addTranslations() function until a patch is available to prevent exploitation. Restrict access to the gettext.js module to minimize the risk of exploitation. Avoid using unsanitized user input in the addTranslations() function until the issue is resolved.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2024-21528

GHSA-G974-HXVM-X689

Affected Products

Node-Gettext

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-21528 · Security Note
• https://osv.dev/vulnerability/GHSA-g974-hxvm-x689 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21528 · Vendor Advisory
• https://github.com/alexanderwallin/node-gettext/blob/65d9670f691c2eeca40dce129c95bcf8b613d344/lib/gettext.js%23L113 · Note
• https://github.com/alexanderwallin/node-gettext · Note
• https://github.com/alexanderwallin/node-gettext/blob/65d9670f691c2eeca40dce129c95bcf8b613d344/lib/gettext.js#L113 · Note
• https://twitter.com/CVEnew/status/1833373802295922797 · Twitter Post
• https://t.me/cvenotify/93914 · Telegram Post
• https://security.snyk.io/vuln/SNYK-JS-NODEGETTEXT-6100943 · Note
• https://t.me/cvedetector/5174 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1833476889727386105 · Twitter Post