Medium

Cross-Site Scripting in i18next

Disclosed: 09.11.2018
Updated: 11.10.2026 10:22

Affected versions of i18next allow untrusted user input to be injected into dictionary key names, resulting in a cross-site scripting vulnerability.

Proof of Concept

var init = i18n.init({debug: true}, function(){
  var test = i18n.t('__firstName__ __lastName__', {
        escapeInterpolation: true,
        firstName: '__lastNameHTML__',
        lastName: '<script>',
  });
  console.log(test);
});
// equals "<script> &lt;script&gt;"

Recommendation

Update to version 1.10.3 or later.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	i18next	< 1.10.3	1.10.3

References

CVSS score 6.1/10

CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-79
Platform: npm
Package: i18next
Disclosed: 09.11.2018
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-f89g-whpf-6q9m - CC BY 4.0

Vulnerability history: i18next

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 2
First → latest: 07.2018 11.2018
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Medium 2

Disclosures per year

2018: 2
2019: 0
2020: 0
2021: 0
2022: 0
2023: 0
2024: 0
2025: 0
2026: 0

09.11.2018

Cross-Site Scripting in i18next this entry

Medium · 6.1 CVE-2017-16008 < 1.10.3 1.10.3
24.07.2018

Cross-Site Scripting in i18next

Medium · 6.1 CVE-2017-16010 >= 2.0.0, < 3.4.4 3.4.4

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application