I18Nextify
Approved changes feed: RSS · Atom
cpe:2.3:a:i18next:i18nextify:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | I18Next (a5183295-a199-5245-92a0-67861c9ae2d3) |
|---|---|
| Product | I18Nextify (cb8a88d8-2e75-595d-86f7-9b4890ce2515) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/i18next/i18nextify |
purl2cpe | 2026-06-01 10:18:18.952503 |
pkg:npm/i18nextify |
purl2cpe | 2026-06-01 10:18:18.952506 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-41692 |
vulnerable | 2026-06-08 08:03:15.706200 |
i18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributes
MEDIUM (4.7)
i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (the replaceInside handler) only guards against a duplicated http:// origin prefix — it does not validate the URL scheme of the substituted value. A translated value such as javascript:alert(1) or data:text/html,<script>...</script> is applied unchanged to the live DOM attribute when an attacker can influence the content of a translation file or the translation-backend response — for example, via a compromised translation CDN, user-contributed locales, a MITM on a plain-HTTP backend, or write access to the translation JSON. This issue was patched in version 4.0.8.
Published: 2026-05-07T20:01:59.272Z
Updated: 2026-05-11T18:04:43.650Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.