Cross-Site Scripting in i18next (GHSA-cmh5-qc8w-xvcq)

Description

Affected versions of i18next may fail to sanitize user input when certain configuration options are used. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true.

Recommendation

Update the i18next package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.0.0, < 3.4.4
• Patched version(s): 3.4.4

References

• GHSA-cmh5-qc8w-xvcq
• www.npmjs.com
• CVE-2017-16010
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Prototype Pollution in lodash (GHSA-jf85-cpcp-j695) 4 - CVE-2019-10744
• Prototype Pollution in lodash (GHSA-jf85-cpcp-j695) 2 - CVE-2019-10744
• Passbolt Browser Extension leaks password information - CVE-2024-33669
• JSONata expression can pollute the "Object" prototype - CVE-2024-27307

Tags:

npm

i18next