Medium, CVSS 4.7npmAmendedPublished
i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes
CVE-2026-41692 · GHSA-6457-mxpq-4fqq
- Affected
- npm i18nextify < 4.0.8
- Fixed in
- 4.0.8· Vendor fix available
- Issue
- Versions of i18nextify prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (replaceInside handler around line 122) only guards against a duplicated http:// origin prefix — it does not validate the URL scheme of the substituted value. A translated value such as javascript:alert(1) or data:text/html,<script...</script is applied unchanged to the live DOM attribute. Impact When an attacker can influence the content of a translation file or the translation-backend response — compromised translation CDN, user-contributed locales, MITM on a plain-HTTP backend, write access to the translation JSON — they can: - Set any href on an anchor to a javascript: URI, executing arbitrary JavaScript when the victim clicks the link. - Set any src on <iframe, <object, or <embed to a data:text/html URI containing a full script payload that runs in the page's origin. - Use…
Recommended action: Upgrade to 4.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.