# CVE-2017-16010: i18next cross-site scripting in interpolation

Source: https://junglewise.ai/threats/cve-2017-16010-i18next-cross-site-scripting-in-interpolation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-07-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2017-16010 · Severity: low · CVSS 3 · Published 2018-07-24

i18next is a popular internationalization library used to translate and localize web applications. A flaw in its interpolation handler can allow attackers to inject malicious JavaScript code into translated strings when custom interpolation settings are configured. If exploited, an attacker could steal user sessions, hijack accounts, or redirect users to malicious sites.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2017-16010 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-16010 being exploited in the wild.

**How severe is CVE-2017-16010?** Low severity, with a CVSS score of 3, published 24 July 2018.

**Which products and versions are affected?** i18next (npm) SEMVER:introduced=2.0.0,fixed=3.4.4.

**Is there a fix for CVE-2017-16010?** Yes. i18next (npm): upgrade to 3.4.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-16010 attacked?** It is attacked over the network.

**Am I affected by CVE-2017-16010?** Check whether you run i18next (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- i18next (npm): upgrade to 3.4.4 or later

  ```sh
  npm install i18next@3.4.4
  ```


## Technical details

The vulnerability is a cross-site scripting (XSS) flaw in i18next versions 2.0.0 through 3.4.3. When the .init() method is called with custom interpolation options but without explicitly setting the escapeValue parameter, the default value incorrectly falls back to undefined instead of the documented true. This allows user-supplied values passed to the .t() translation function to be rendered without HTML escaping, enabling script injection. The attack requires no authentication and can be triggered via application-specific translation calls with attacker-controlled interpolation data. The vulnerability was fixed in version 3.4.4.

## Affected products

- i18next i18next 2.0.0 through 3.4.3

## Identifiers

- CVE-2017-16010
- GHSA-cmh5-qc8w-xvcq

## Timeline

- 2018-07-24: disclosed
- 2016-10-17: patched: Fix merged to master branch (PR #826)

## References

- [https://github.com/i18next/i18next/pull/826](https://github.com/i18next/i18next/pull/826)

## Related threats

- [i18next cross-site scripting in interpolation](https://junglewise.ai/threats/cve-2017-16008-i18next-cross-site-scripting-in-interpolation)