@onshape/ng-i18next (0.3.12), amdblah-hbs-helpers (>=0.0.1, <=0.2.1) +21 more potentially affected by CVE-2017-16008 via i18next (>=1.5.0, <=1.10.2)

i18next NPM version =1.5.0, =0.0.1, =0.0.3, =0.4.3, =0.3.1, =0.10.11, =0.1.10, =1.0.2, =0.3.3, =0.0.1, =0.0.1, =0.11.0, =0.11.2 - openinghours 3.3.0 and more Source cves: CVE-2017-16008 Source advisory: OSV:GHSA-F89G-WHPF-6Q9M...

CVE-2017-16008

creationtimestamp| type| source ---|---|--- 2018-11-09 17:46:56+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-f89g-whpf-6q9m...

CVE-2017-16008

CVE-2017-16008 affects the i18next translation framework. The vulnerability arises from how interpolation replaces dictionary keys one at a time, allowing untrusted input to inject script via key names in versions ≤ 1.10.2. Multiple sources (OSV, CNVD, NVD cross-reference) document this XSS flaw ...