GitHub Advisoryadvisory · npm
GHSA-f89g-whpf-6q9m Cross-Site Scripting in i18next
MEDIUM
Official page ↗
- Aliases
- CVE-2017-16008
- Ecosystem
- npm
- Packages
- i18next
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2020-06-16
Affected packages
• npm i18next: < 1.10.3 → fixed in 1.10.3
Description
Affected versions of `i18next` allow untrusted user input to be injected into dictionary key names, resulting in a cross-site scripting vulnerability.
Proof of Concept
```js
var init = i18n.init({debug: true}, function(){
var test = i18n.t('__firstName__ __lastName__', {
escapeInterpolation: true,
firstName: '__lastNameHTML__',
lastName: '',
});
console.log(test);
});
// equals " <script>"
```
Recommendation
Update to version 1.10.3 or later.
Related
Alias · CVE (1)
- CVE-2017-16008 i18next is a language translation framework. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness