Threats affecting pkg:pypi/LibreTranslate

CVE-2026-57942 is an IP spoofing vulnerability in LibreTranslate versions up to 1.9.7. The flaw exists in the get_remote_address() function, which fails to properly validate the X-Forwarded-For header from untrusted sources. This allows unauthenticated attackers to spoof client IP addresses, bypassing per-IP rate limiting and flood bans, potentially enabling unlimited API abuse. The issue was fixed in a commit identified as 397fd22.