Description
Versions of the locize client SDK (the browser module that wires up the locize InContext translation editor) prior to 4.0.21 register a window.addEventListener("message", …) handler that dispatches to registered internal handlers (editKey, commitKey, commitKeys, isLocizeEnabled, requestInitialize, …) without validating event.origin.
Recommendation
Update the locize package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.0.21
- Patched version(s): 4.0.21
References
Could your website be exposed too?
SmartScanner can check your website for locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor and gives you actionable findings to investigate.
Start a free scanRelated Issues
- CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage - CVE-2026-26862
- CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function - CVE-2026-26861
- TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments - CVE-2026-47762
- RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions - CVE-2026-42190
You might also like:
See something that needs correcting? Let us knowUpdated May 13, 2026