Executive brief
i18next is a JavaScript library for managing multi-language translations in web applications. The library contains a cross-site scripting vulnerability in its string interpolation mechanism that allows attackers to inject malicious scripts through dictionary key names or user-supplied values, potentially compromising application users' sessions or stealing sensitive data.
Technical details
The vulnerability is a stored/reflected XSS (CWE-79) in the string interpolation replacement logic within i18next. The root cause is that the library performs sequential string replacements on user-supplied values without proper escaping during the interpolation resolution phase. When a translation key contains a placeholder (e.g., '__firstName__'), and the dictionary value for that placeholder includes another placeholder name (e.g., '__lastNameHTML__'), the sequential replacement algorithm processes these iteratively, allowing unescaped HTML/script injection. An attacker can craft dictionary entries or supply values that exploit this order-of-operations flaw. The vulnerability is network-reachable and requires user interaction (e.g., user input reflected into a translation string). It was fixed in version 1.10.3 with a reimplementation of the replacement algorithm.
Affected products
- i18next i18next <= 1.10.2
Timeline
- 2018-11-09: disclosed
- 2015-10-19: patched: Fix merged in PR #443; patch released in version 1.10.3