Executive brief
i18next is a popular internationalization library used to translate and localize web applications. A flaw in its interpolation handler can allow attackers to inject malicious JavaScript code into translated strings when custom interpolation settings are configured. If exploited, an attacker could steal user sessions, hijack accounts, or redirect users to malicious sites.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in i18next versions 2.0.0 through 3.4.3. When the .init() method is called with custom interpolation options but without explicitly setting the escapeValue parameter, the default value incorrectly falls back to undefined instead of the documented true. This allows user-supplied values passed to the .t() translation function to be rendered without HTML escaping, enabling script injection. The attack requires no authentication and can be triggered via application-specific translation calls with attacker-controlled interpolation data. The vulnerability was fixed in version 3.4.4.
Affected products
- i18next i18next 2.0.0 through 3.4.3
Timeline
- 2018-07-24: disclosed
- 2016-10-17: patched: Fix merged to master branch (PR #826)