Affected versions of i18next allow untrusted user input to be injected into dictionary key names, resulting in a cross-site scripting vulnerability.

Proof of Concept js var init = i18n.init({debug: true}, function(){ var test = i18n.t('firstName lastName', { escapeInterpolation: true, firstName: 'lastNameHTML', lastName: '<script>', }); console.log(test); }); // equals "<script> &lt;script&gt;"

Recommendation

Update to version 1.10.3 or later.