Description
Versions of i18nextify prior to 4.0.8 substitute `` interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (replaceInside handler around line 122) only guards against a duplicated http:// origin prefix — it does not validate the URL scheme of the substituted value.
Recommendation
Update the i18nextify package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.0.8
- Patched version(s): 4.0.8
References
Could your website be exposed too?
SmartScanner can check your website for i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes and gives you actionable findings to investigate.
Start a free scanRelated Issues
- TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - CVE-2026-47759
- SCEditor has DOM XSS via emoticon URL/HTML injection - CVE-2026-25581
- Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS - CVE-2026-62324
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx - CVE-2026-55661
You might also like:
See something that needs correcting? Let us knowUpdated May 11, 2026