A critical privacy vulnerability (CVE-2025-55014) has been reported in StarDict, a GPLv3-licensed cross-platform dictionary application, running under Debian's default X11 configuration. The "scan" feature, enabled by default when stardict-plugin is installed, automatically sends user-selected text (clipboard content) over unencrypted HTTP to two remote Chinese dictionary servers (YouDao and dict.cn). This unconsented data transmission poses a significant risk of exposing confidential information like passwords, emails, or private documents. The issue, a recurrence of similar problems from 2009 and 2015, highlights a fundamental disagreement between the bug reporter and the Debian maintainer regarding "secure-by-default" principles, and underscores the challenges of maintaining security in large software distributions. A fix involving splitting network plugins into a separate, non-default package is planned.
Summarizing the StarDict Privacy Vulnerability:
0:00 (Vulnerability Introduction): StarDict, a cross-platform dictionary application, is found to send user text selections (X11 clipboard content) over unencrypted HTTP to two Chinese dictionary servers (YouDao and dict.cn) by default in Debian's configuration.
Default Installation & Behavior: The stardict-plugin package, which is installed by default because stardict-gtk "recommends" it, enables this functionality via its YouDao plugin. StarDict's "scan" feature, also enabled by default, monitors highlighted text and automatically sends it for translation.
X11 Specific: This vulnerability primarily affects X11 environments; Wayland's security model inherently prevents inter-application text capture, although it also breaks StarDict's "scan" feature.
Maintainer's Stance: The Debian package maintainer, Xiao Sheng Wen, initially deemed the issue a "wishlist" item, arguing that users can disable the feature and should not select confidential data for translation.
Reporter's Argument: Vincent Lefevre, who reported the bug (CVE-2025-55014), emphasized that privacy-sensitive features should never be enabled by default, especially when installed automatically, without clear warnings.
Unencrypted Transmission: The data is sent via unencrypted HTTP, making it vulnerable to interception and viewing by anyone monitoring network traffic.
Recurrent Problem: This is not the first time StarDict has exhibited such behavior; similar issues were reported in 2009 (patched, but later circumvented by the 2016 YouDao plugin) and 2015 (only recently addressed by removing a related plugin).
Potential Impact: Despite a relatively small active user base (around 178 Debian users in popcon stats), the vulnerability could have exposed sensitive user data (e.g., passwords, private documents) for several years.
Debian Maintenance Challenges: The incident illustrates the difficulties in ensuring security in large distributions with numerous older packages, particularly when maintainers have differing views on security priorities and "secure-by-default" policies.
Planned Fix: The maintainer plans to address the issue in Debian 13.1 by splitting the network dictionary plugins into a new, separate package (stardict-plugin-network-dictionary) that will not be installed by default and will include explicit warnings.
Community Discussion (Hacker News):
Users expressed strong concern and disbelief over the default, unencrypted transmission of clipboard data, with some implying malicious intent.
The maintainer's response questioning why users would select confidential data was heavily criticized.
Discussions touched upon the real-world risks of data exposure, including cryptocurrency seed phrases and credentials.
Android's stricter clipboard and network permissions were cited as a more secure approach.
Suggestions were made to simply use offline dictionaries as a straightforward solution.
One comment sarcastically compared the data collection to modern web browsers.