CVE-2017-16008: XSS
Affected versions of i18next allow untrusted user input to be injected into dictionary key names, resulting in a cross-site scripting vulnerability.
Proof of Concept js var init = i18n.init({debug: true}, function(){ var test = i18n.t('firstName lastName', { escapeInterpolation: true, firstName: 'lastNameHTML', lastName: '<script>', }); console.log(test); }); // equals "<script> <script>"
Recommendation
Update to version 1.10.3 or later.
Other sources
i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted user input can use the name of one of the dictionary keys to inject script into the browser. This affects i18next <=1.10.2.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16008?
The severity of CVE-2017-16008 is rated as medium with a score of 6.1.
What is the risk associated with CVE-2017-16008?
CVE-2017-16008 poses a risk score of 38 due to potential cross-site scripting vulnerabilities.
How do I fix CVE-2017-16008?
To fix CVE-2017-16008, apply the available patches provided in the i18next repository.
Which software is affected by CVE-2017-16008?
CVE-2017-16008 affects the i18next library used in Node.js applications.
How does CVE-2017-16008 allow cross-site scripting?
CVE-2017-16008 allows untrusted user input to be injected into dictionary key names, creating a vector for cross-site scripting.