# CVE-2017-16008: i18next cross-site scripting in interpolation

Source: https://junglewise.ai/threats/cve-2017-16008-i18next-cross-site-scripting-in-interpolation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-11-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2017-16008 · Severity: low · CVSS 3 · Published 2018-11-09

i18next is a JavaScript library for managing multi-language translations in web applications. The library contains a cross-site scripting vulnerability in its string interpolation mechanism that allows attackers to inject malicious scripts through dictionary key names or user-supplied values, potentially compromising application users' sessions or stealing sensitive data.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2017-16008 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-16008 being exploited in the wild.

**How severe is CVE-2017-16008?** Low severity, with a CVSS score of 3, published 9 November 2018.

**Which products and versions are affected?** i18next (npm) SEMVER:introduced=0,fixed=1.10.3.

**Is there a fix for CVE-2017-16008?** Yes. i18next (npm): upgrade to 1.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-16008 attacked?** It is attacked over the network.

**Am I affected by CVE-2017-16008?** Check whether you run i18next (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- i18next (npm): upgrade to 1.10.3 or later

  ```sh
  npm install i18next@1.10.3
  ```


## Technical details

The vulnerability is a stored/reflected XSS (CWE-79) in the string interpolation replacement logic within i18next. The root cause is that the library performs sequential string replacements on user-supplied values without proper escaping during the interpolation resolution phase. When a translation key contains a placeholder (e.g., '__firstName__'), and the dictionary value for that placeholder includes another placeholder name (e.g., '__lastNameHTML__'), the sequential replacement algorithm processes these iteratively, allowing unescaped HTML/script injection. An attacker can craft dictionary entries or supply values that exploit this order-of-operations flaw. The vulnerability is network-reachable and requires user interaction (e.g., user input reflected into a translation string). It was fixed in version 1.10.3 with a reimplementation of the replacement algorithm.

## Affected products

- i18next i18next <= 1.10.2

## Identifiers

- CVE-2017-16008
- GHSA-f89g-whpf-6q9m

## Timeline

- 2018-11-09: disclosed
- 2015-10-19: patched: Fix merged in PR #443; patch released in version 1.10.3

## References

- [https://github.com/i18next/i18next/pull/443](https://github.com/i18next/i18next/pull/443)

## Related threats

- [i18next cross-site scripting in interpolation](https://junglewise.ai/threats/cve-2017-16010-i18next-cross-site-scripting-in-interpolation)