PT-2018-6040 · I18Next · I18Next

Alexmchardy · Published 2018-05-29 · Updated 2019-10-09 · CVE-2017-16010

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: i18next versions 2.0.0 and later

Description: The issue concerns a cross-site scripting vulnerability in the i18next language translation framework. When using the .init method and passing interpolation options without specifying an escapeValue, it defaults to undefined instead of the assumed true. This can lead to user input not being properly escaped, resulting in a potential security risk.

Recommendations: Update to version 3.4.4 or later. As a temporary workaround, consider explicitly passing the escapeValue option as true when initializing i18next to ensure user input is properly sanitized.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-16010

GHSA-CMH5-QC8W-XVCQ

Affected Products

I18Next

References · 7

• 🔥 https://github.com/i18next/i18next/pull/826 · Exploit
• 🔥 https://nodesecurity.io/advisories/326 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-16010 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16010 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cmh5-qc8w-xvcq · Vendor Advisory
• https://npmjs.com/advisories/326 · Note
• https://github.com/advisories/GHSA-cmh5-qc8w-xvcq · Note