Use of Unencrypted HTTP Request in dectalk-tts

published 2024-04-04 2 y ago modified 2026-09-10 1 mo ago also GHSA-6cf6-8hvr-r68w , EUVD-2024-1122

cvss: 8.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits: 0; none known

dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it.

Patch / fix

fixed in 1 links 2

npm dectalk-tts 1.0.1

github.com/JstnMcBrd/dectalk-tts@3600d8a commit
github.com/JstnMcBrd/dectalk-tts#4 pull request

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago (2024-04-05)

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
GitHub	3.1	8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	dectalk-tts	>=1.0.0, <1.0.1	1.0.1

Affected products

JstnMcBrd dectalk-tts

Classification

Weakness

CWE-300 Channel Accessible by Non-Endpoint
CWE-319 Cleartext Transmission of Sensitive Information
CWE-598 Use of HTTP Request With Sensitive Query String

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary