Cross-Site Scripting in i18next

Description

Affected versions of i18next allow untrusted user input to be injected into dictionary key names, resulting in a cross-site scripting vulnerability.

Recommendation

Update the i18next package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.10.2
• Patched version(s): 1.10.3

References

• GHSA-f89g-whpf-6q9m
• www.npmjs.com
• CVE-2017-16008
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-Site Scripting in i18next (GHSA-cmh5-qc8w-xvcq) - CVE-2017-16010
• Cross-Site Scripting in sanitize-html - CVE-2017-16017
• Cross-Site Scripting in @novnc/novnc - CVE-2017-18635
• Cross-Site Scripting in html-janitor - CVE-2017-0931

Tags:

npm

i18next