Executive brief
locize is a localization platform used to manage website translations. A security flaw in its client-side software allows malicious websites to send unauthorized commands to a site using locize if a user visits both sites simultaneously. This could allow an attacker to modify website content, steal translation data, or execute malicious scripts in the user's browser session.
Technical details
The locize client SDK (prior to v4.0.21) registers a 'message' event listener in src/api/postMessage.js that fails to verify the event.origin property. Instead, it relies on a user-controlled 'sender' field within the message payload. An attacker can exploit this by using window.postMessage from a malicious frame or window to trigger internal handlers such as editKey, commitKeys, and isLocizeEnabled. This leads to DOM XSS via unsanitized innerHTML assignments, hijacking of the API source/origin for data exfiltration, and CSS injection. Exploitation requires a shared window reference, such as an iframe or a window.opener relationship.
Affected products
- locize locize < 4.0.21
Timeline
- 2026-04-18: patched: Version 4.0.21 released
- 2026-05-08: disclosed: CVE-2026-41886 published