Cross-Site Scripting in i18next - i18next

Description

Affected versions of i18next may fail to sanitize user input when certain configuration options are used. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true.

Recommendation

Update the i18next package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.0.0, < 3.4.4
• Patched version(s): 3.4.4

References

• GHSA-cmh5-qc8w-xvcq
• www.npmjs.com
• CVE-2017-16010
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-Site Scripting in i18next - CVE-2017-16008
• Cross-Site Scripting in sanitize-html - CVE-2017-16017
• Cross-Site Scripting in @novnc/novnc - CVE-2017-18635
• Cross-Site Scripting in html-janitor - CVE-2017-0931

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

i18next