Cross-Site Scripting

Overview

Affected versions of i18next allow untrusted user input to be injected into dictionary key names, resulting in a cross-site scripting vulnerability.

Proof of Concept

var init = i18n.init({debug: true}, function(){
  var test = i18n.t('__firstName__ __lastName__', {
        escapeInterpolation: true,
        firstName: '__lastNameHTML__',
        lastName: '<script>',
  });
  console.log(test);
});
// equals "<script> <script>"

Recommendation

Update to version 1.10.3 or later.

References

• PR #443
• GitHub Advisory