CVE-2024-31206

dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it.

• CWE-300
• CWE-319
• CWE-598

• https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18
• https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105
• https://github.com/JstnMcBrd/dectalk-tts/issues/3
• https://github.com/JstnMcBrd/dectalk-tts/pull/4
• https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w
• https://github.com/JstnMcBrd/dectalk-tts/blob/b3e92156cbb699218ac9b9c7d8979abd0e635767/src/index.ts#L18
• https://github.com/JstnMcBrd/dectalk-tts/commit/3600d8ac156f27da553ac4ead46d16989a350105
• https://github.com/JstnMcBrd/dectalk-tts/issues/3
• https://github.com/JstnMcBrd/dectalk-tts/pull/4
• https://github.com/JstnMcBrd/dectalk-tts/security/advisories/GHSA-6cf6-8hvr-r68w

Published

Apr 4, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31200A “CWE-201: Insertion of Sensitive Information Into Sent Dat…4.6
• CVE-2024-31201A “CWE-428: Unquoted Search Path or Element” affects the The…6.7
• CVE-2024-31202A “CWE-732: Incorrect Permission Assignment for Critical Res…7.8
• CVE-2024-31203A “CWE-121: Stack-based Buffer Overflow” in the wd210std.dll…5.5
• CVE-2024-31204mailcow: dockerized is an open source groupware/email suite …6.1
• CVE-2024-31205Saleor is an e-commerce platform. Starting in version 3.10.0…5.4
• CVE-2024-31207Vite (French word for "quick", pronounced /vit/, like "veet"…5.9
• CVE-2024-31208Synapse is an open-source Matrix homeserver. A remote Matrix…6.5
• CVE-2024-31209oidcc is the OpenID Connect client library for Erlang. Denia…5.3
• CVE-2024-3121A remote code execution vulnerability exists in the create_c…3.3
• CVE-2024-31210WordPress is an open publishing platform for the Web. It's p…8.8
• CVE-2024-31211WordPress is an open publishing platform for the Web. Unseri…9.8