{"id":"EUVD-2026-28440","enisaUuid":"d471c6a9-72d9-3780-bba9-e36097c62932","description":"i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (the replaceInside handler) only guards against a duplicated http:// origin prefix — it does not validate the URL scheme of the substituted value. A translated value such as javascript:alert(1) or data:text/html,\u003cscript\u003e...\u003c/script\u003e is applied unchanged to the live DOM attribute when an attacker can influence the content of a translation file or the translation-backend response — for example, via a compromised translation CDN, user-contributed locales, a MITM on a plain-HTTP backend, or write access to the translation JSON. This issue was patched in version 4.0.8.","datePublished":"May 7, 2026, 8:01:59 PM","dateUpdated":"May 11, 2026, 6:04:43 PM","baseScore":4.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/i18next/i18nextify/security/advisories/GHSA-6457-mxpq-4fqq\nhttps://github.com/i18next/i18nextify/commit/16f23dbcdcf893673587f7a03355bf7ce0a0e49e\n","aliases":"CVE-2026-41692\n","assigner":"GitHub_M","epss":0.14,"enisaIdProduct":[{"id":"3e88bede-80fc-39f5-8492-938ef9d67dd9","product":{"name":"i18nextify","vendor":{"name":"i18next"}},"product_version":"\u003c 4.0.8"}],"enisaIdVendor":[{"id":"72fc7429-efd6-3387-a911-72458b0aced0","vendor":{"name":"i18next"}}],"enisaIdVulnerability":[{"id":"4d09ede9-7b61-3de5-a3dd-4d364a2ac6b8","vulnerability":{"id":"CVE-2026-41692","description":"i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (the replaceInside handler) only guards against a duplicated http:// origin prefix — it does not validate the URL scheme of the substituted value. A translated value such as javascript:alert(1) or data:text/html,\u003cscript\u003e...\u003c/script\u003e is applied unchanged to the live DOM attribute when an attacker can influence the content of a translation file or the translation-backend response — for example, via a compromised translation CDN, user-contributed locales, a MITM on a plain-HTTP backend, or write access to the translation JSON. This issue was patched in version 4.0.8.","datePublished":"May 7, 2026, 8:01:59 PM","dateUpdated":"May 11, 2026, 6:04:43 PM","status":"PUBLISHED","baseScore":4.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/i18next/i18nextify/security/advisories/GHSA-6457-mxpq-4fqq\nhttps://github.com/i18next/i18nextify/commit/16f23dbcdcf893673587f7a03355bf7ce0a0e49e\n","enisa_id":"EUVD-2026-28440\n","assigner":"GitHub_M","epss":0.14,"dataProcessed":"Oct 27, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"03e3e904-00de-359a-a88e-7b7d0f744139","product":{"name":"i18nextify","vendor":{"name":"i18next"}},"product_version":"\u003c 4.0.8"}],"vulnerabilityVendor":[{"id":"2b07b1b4-4a57-35cd-b69a-fcd8961342bc","vendor":{"name":"i18next"}}]}}],"enisaIdAdvisory":[]}