Medium

Cross-Site Scripting in i18next

Disclosed: 24.07.2018
Updated: 11.10.2026 10:22

Affected versions of i18next may fail to sanitize user input when certain configuration options are used. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true.

Proof of Concept

var init = i18n.init({
  interpolation: {
    prefix: "__",
    suffix: "__",
    escapeValue: true
  }
}, function(){
  var test = i18n.t('__firstName__ __lastName__', {
        firstName: 'Bob',
        lastName: '["foo","bar"]',
  });
  console.log(test);
});

When escapeValue is explicitly passed, the result of test is:

html

&lt;script&gt;alert(1)&lt;&#x2F;script&gt; Johnson

This is supposed to be the default. However, if escapeValue is not included, the result is the unescaped string:

html

<script>alert(1)</script> Johnson

Recommendation

Update to version 3.4.4 or later.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	i18next	>= 2.0.0, < 3.4.4	3.4.4

References

CVSS score 6.1/10

CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-79
Platform: npm
Package: i18next
Disclosed: 24.07.2018
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-cmh5-qc8w-xvcq - CC BY 4.0

Vulnerability history: i18next

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 2
First → latest: 07.2018 11.2018
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Medium 2

Disclosures per year

2018: 2
2019: 0
2020: 0
2021: 0
2022: 0
2023: 0
2024: 0
2025: 0
2026: 0

09.11.2018

Cross-Site Scripting in i18next

Medium · 6.1 CVE-2017-16008 < 1.10.3 1.10.3
24.07.2018

Cross-Site Scripting in i18next this entry

Medium · 6.1 CVE-2017-16010 >= 2.0.0, < 3.4.4 3.4.4

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application