i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes

Description

Versions of i18nextify prior to 4.0.8 substitute `` interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (replaceInside handler around line 122) only guards against a duplicated http:// origin prefix — it does not validate the URL scheme of the substituted value.

Recommendation

Update the i18nextify package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.0.8
• Patched version(s): 4.0.8

References

• GHSA-6457-mxpq-4fqq
• CVE-2026-41692
• CWE-79
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - CVE-2026-47759
• SCEditor has DOM XSS via emoticon URL/HTML injection - CVE-2026-25581
• Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS - CVE-2026-62324
• TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx - CVE-2026-55661

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

i18nextify