Security vulnerabilities and automated fixes for iso 639 1 issues
1 post found
A missing input validation step in `src/module/translator/deepl.js` allowed raw, user-controlled language codes to flow directly into DeepL API requests without any sanitization. This created an exploit primitive where malicious language strings—containing XSS payloads or SQL fragments—could be forwarded to an external translation service. The fix introduces a strict ISO 639-1/BCP 47 regex guard that rejects any non-conforming input before it reaches the API call.