CVE-2026-41692: i18nextify DOM XSS in translated href and src attributes

CVE-2026-41692 · Severity: medium · CVSS 4.7 · Published 2026-05-07

i18nextify is a JavaScript library used to automatically translate website content into different languages. A security flaw allows an attacker who can control translation data (for example, by compromising a translation provider or intercepting network traffic) to inject malicious code into the website. This could lead to unauthorized actions being performed in a user's browser, such as stealing session information or redirecting users to malicious sites when they click links.

Vendors: npm.

Quick answers

Is CVE-2026-41692 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41692 being exploited in the wild.
How severe is CVE-2026-41692?
Medium severity, with a CVSS score of 4.7, published 7 May 2026.
Which products and versions are affected?
i18nextify (npm) < 4.0.8, SEMVER:introduced=0,fixed=4.0.8.
Is there a fix for CVE-2026-41692?
Yes. i18nextify (npm): upgrade to 4.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41692 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41692?
Check whether you run i18nextify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • i18nextify (npm): upgrade to 4.0.8 or later
    npm install i18nextify@4.0.8

Technical details

i18nextify versions prior to 4.0.8 contain a DOM XSS vulnerability in the 'replaceInside' handler within 'src/localize.js'. The library substitutes {{key}} interpolation tokens into 'src' and 'href' attributes without validating the URL scheme of the translated string. If an attacker can influence the translation source (via a compromised CDN, MITM on plain-HTTP backends, or malicious user-contributed locales), they can inject 'javascript:', 'data:', or 'vbscript:' URIs. When these translated values are applied to the DOM, they can execute arbitrary JavaScript in the context of the victim's browser session. The issue is patched in version 4.0.8, which introduces a blocklist for dangerous URL schemes.

Affected products

  • i18next i18nextify < 4.0.8

Identifiers

  • CVE-2026-41692
  • GHSA-6457-mxpq-4fqq

Timeline

  • 2026-04-18: advisory: GitHub advisory published by maintainers
  • 2026-05-07: disclosed: CVE-2026-41692 published
  • 2026-05-07: patched: Version 4.0.8 released with security hardening

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.