CVE-2026-41692
XSS via Unsafe URL Substitution in i18nextify
Publication date: 2026-05-07
Last updated on: 2026-05-07
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| i18nextify | i18nextify | to 4.0.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the i18nextify JavaScript library versions prior to 4.0.8. This library adds website internationalization by substituting {{key}} interpolation tokens inside src and href attribute values with translated strings. However, the substitution logic only prevents duplicated http:// prefixes and does not validate the URL scheme of the substituted value.
As a result, an attacker who can influence the translation content—such as through a compromised translation CDN, user-contributed locales, a man-in-the-middle attack on an unencrypted backend, or write access to the translation JSON—can inject malicious URL schemes like javascript: or data: into these attributes. This causes the malicious code to be applied directly to the live DOM, potentially leading to cross-site scripting (XSS) attacks.
This issue was fixed in version 4.0.8 of i18nextify.
How can this vulnerability impact me? :
This vulnerability can lead to cross-site scripting (XSS) attacks by allowing attackers to inject malicious scripts into the src or href attributes of a website using the i18nextify library. If exploited, it can result in unauthorized script execution in users' browsers.
- Compromise of user data through theft of cookies or session tokens.
- Execution of arbitrary malicious code in the context of the affected website.
- Potential redirection to malicious websites or phishing pages.
- Loss of user trust and damage to the website's reputation.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade the i18nextify library to version 4.0.8 or later, where the issue has been patched.