Most recent entries from all

EUVD-2026-310014

fkie_cve-2026-41692

i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (the replaceInside handler) only guards against a duplicated http:// origin prefix — it does not validate the URL scheme of the substituted value. A translated value such as javascript:alert(1) or data:text/html,<script>...</script> is applied unchanged to the live DOM attribute when an attacker can influence the content of a translation file or the translation-backend response — for example, via a compromised translation CDN, user-contributed locales, a MITM on a plain-HTTP backend, or write access to the translation JSON. This issue was patched in version 4.0.8.

GHSA-6457-mxpq-4fqq — i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes

Affected: npm: i18nextify

### Summary

Versions of `i18nextify` prior to 4.0.8 substitute `{{key}}` interpolation tokens inside `src` and `href` attribute values with the raw string returned by `i18next.t()`. The substitution logic in `src/localize.js` (`replaceInside` handler around line 122) only guards against a duplicated `http://` origin prefix — it does not validate the URL scheme of the substituted value. A translated value such as `javascript:alert(1)` or `data:text/html,<script>...</script>` is applied unchanged to the live DOM attribute.

### Impact

When an attacker can influence the content of a translation file or the translation-backend response — compromised translation CDN, user-contributed locales, MITM on a plain-HTTP backend, write access to the translation JSON — they can:

- Set any `href` on an anchor to a `javascript:` URI, executing arbitrary JavaScript when the victim clicks the link. - Set any `src` on `<iframe>`, `<object>`, or `<embed>` to a `data:text/html` URI containing a full script payload that runs in the page's origin. - Use `vbscript:` on legacy IE installations or `file:` for local-resource navigation attacks.

This path is distinct from the general i18nextify design that intentionally renders HTML from translations — href/src schemes are narrow and attack-specific, and no legitimate translation needs `javascript:` or `data:`. The fix therefore blocks these schemes outright without changing other behaviour.

### Also fixed in 4.0.8

- **`debug` / `saveMissing` URL…