CVE-2017-16010

Removed by vendor...

Cross-site Scripting (XSS)

i18next is vulnerable to cross-site scripting XSS attacks. When the .init method is called by passing interpolation options without passing an escapeValue, it set to undefined rather than true by default, not escaping user input...

Cross-Site Scripting

Overview Affected versions of i18next may fail to sanitize user input when certain configuration options are used. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. Proof of Concept var init = i18n.ini...

Cross-Site Scripting

Overview Affected versions of i18next allow untrusted user input to be injected into dictionary key names, resulting in a cross-site scripting vulnerability. Proof of Concept var init = i18n.initdebug: true, function var test = i18n.t'firstName lastName', escapeInterpolation: true, firstName:...

Cross-site Scripting (XSS)

i18next is vulnerable to cross-site scripting XSS attacks. The interpolation resolution code in translate.js loops over each key in the dictionary and applies replacements one at a time. It is possible for an untrusted user to input the name of another key in the dictionary. Along with the...