{"id":"EUVD-2026-28440","revision":"42958a2e9e4147f3a0a788d63e84494f","records":[{"revision":"42958a2e9e4147f3a0a788d63e84494f","observedAt":"2026-10-28T05:10:58.997+00:00","statement":{"source":"euvd","id":"EUVD-2026-28440","aliases":["CVE-2026-41692"],"title":"i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw strin…","description":"i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (the replaceInside handler) only guards against a duplicated http:// origin prefix — it does not validate the URL scheme of the substituted value. A translated value such as javascript:alert(1) or data:text/html,<script>...</script> is applied unchanged to the live DOM attribute when an attacker can influence the content of a translation file or the translation-backend response — for example, via a compromised translation CDN, user-contributed locales, a MITM on a plain-HTTP backend, or write access to the translation JSON. This issue was patched in version 4.0.8.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","score":4.7,"severity":null}],"references":["https://github.com/i18next/i18nextify/security/advisories/GHSA-6457-mxpq-4fqq","https://github.com/i18next/i18nextify/commit/16f23dbcdcf893673587f7a03355bf7ce0a0e49e"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28440","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 7, 2026, 8:01:59 PM","dateUpdated":"May 11, 2026, 6:04:43 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-28440","identifiers":["EUVD-2026-28440","CVE-2026-41692"]},"retained":false,"historicalAffected":[]}],"coverage":[]}