PT-2018-6040 · I18Next · I18Next

Alexmchardy · Publicado 2018-05-29 · Atualizado 2019-10-09 · CVE-2017-16010

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: i18next versions 2.0.0 and later

Description: The issue concerns a cross-site scripting vulnerability in the i18next language translation framework. When using the .init method and passing interpolation options without specifying an escapeValue, it defaults to undefined instead of the assumed true. This can lead to user input not being properly escaped, resulting in a potential security risk.

Recommendations: Update to version 3.4.4 or later. As a temporary workaround, consider explicitly passing the escapeValue option as true when initializing i18next to ensure user input is properly sanitized.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-16010

GHSA-CMH5-QC8W-XVCQ

Produtos afetados

I18Next

Referências · 7

• 🔥 https://github.com/i18next/i18next/pull/826 · Exploit
• 🔥 https://nodesecurity.io/advisories/326 · Exploit
• https://npmjs.com/advisories/326 · Nota
• https://github.com/advisories/GHSA-cmh5-qc8w-xvcq · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-16010 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-16010 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-cmh5-qc8w-xvcq · Aviso do Fabricante