Cross-Site Scripting in i18next

Description

Affected versions of i18next allow untrusted user input to be injected into dictionary key names, resulting in a cross-site scripting vulnerability.

Recommendation

Update the i18next package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.10.2
• Patched version(s): 1.10.3

References

• GHSA-f89g-whpf-6q9m
• www.npmjs.com
• CVE-2017-16008
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Command Injection Vulnerability - CVE-2021-21315
• Cloudera HUE Account Enumeration - CVE-2016-4947
• Cross-Site Scripting in exceljs - CVE-2018-16459
• Sensitive data exposure in NATS - CVE-2020-26149

Tags:

npm

i18next