https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:22:54 +0000 https://cve.radiocsirt.org/vuln/cnvd-2018-14353 cnvd-2018-14353 https://cve.radiocsirt.org/vuln/cnvd-2018-14353 https://cve.radiocsirt.org/vuln/euvd-2026-166797 EUVD-2026-166797 https://cve.radiocsirt.org/vuln/euvd-2026-166797 https://cve.radiocsirt.org/vuln/fkie_cve-2017-16008 <p>i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted user input can use the name of one of the dictionary keys to inject script into the browser. This affects i18next &lt;=1.10.2.</p> <p>i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted user input can use the name of one of the dictionary keys to inject script into the browser. This affects i18next &lt;=1.10.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-16008 https://cve.radiocsirt.org/vuln/ghsa-f89g-whpf-6q9m <p><strong>Affected:</strong> npm: i18next</p> <p>Affected versions of `i18next` allow untrusted user input to be injected into dictionary key names, resulting in a cross-site scripting vulnerability.</p> <p>## Proof of Concept ```js var init = i18n.init({debug: true}, function(){ var test = i18n.t(&#39;__firstName__ __lastName__&#39;, { escapeInterpolation: true, firstName: &#39;__lastNameHTML__&#39;, lastName: &#39;&lt;script&gt;&#39;, }); console.log(test); }); // equals &#34;&lt;script&gt; &amp;lt;script&amp;gt;&#34; ```</p> <p>## Recommendation</p> <p>Update to version 1.10.3 or later.</p> <p><strong>Affected:</strong> npm: i18next</p> <p>Affected versions of `i18next` allow untrusted user input to be injected into dictionary key names, resulting in a cross-site scripting vulnerability.</p> <p>## Proof of Concept ```js var init = i18n.init({debug: true}, function(){ var test = i18n.t(&#39;__firstName__ __lastName__&#39;, { escapeInterpolation: true, firstName: &#39;__lastNameHTML__&#39;, lastName: &#39;&lt;script&gt;&#39;, }); console.log(test); }); // equals &#34;&lt;script&gt; &amp;lt;script&amp;gt;&#34; ```</p> <p>## Recommendation</p> <p>Update to version 1.10.3 or later.</p> https://cve.radiocsirt.org/vuln/ghsa-f89g-whpf-6q9m https://cve.radiocsirt.org/vuln/gsd-2017-16008 gsd-2017-16008 https://cve.radiocsirt.org/vuln/gsd-2017-16008