i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes
Date: 2026-04
Affected: npm/i18nextify
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-41692
CWE: CWE-79
CWE-94
CVSS: 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)

### Summary Versions of `i18nextify` prior to 4.0.8 substitute `{{key}}` interpolation tokens inside `src` and `href` attribute values with the raw string returned by `i18next.t()`. The substitution logic in `src/localize.js` (`replaceInside` handler around line 122) only guards against a duplicated `http://` origin prefix — it does not validate the URL scheme of the substituted value. A translated value such as `javascript:alert(1)` or `data:text/html,<script>...</script>` is applied unchanged to the live DOM attribute. ### Impact When an attacker can influence the content of a translation file or the translation-backend response — compromised translation CDN, user-contributed locales, MITM on a plain-HTTP backend, write access to the translation JSON — they can: - Set any `href` on an anchor to a `javascript:` URI, executing arbitrary JavaScript when the victim clicks the link. - Set any `src` on `<iframe>`, `<object>`, or `<embed>` to a `data:text/html` URI containing a full script payload that runs in the page's origin. - Use `vbscript:` on legacy IE installations or `file:` for local-resource navigation attacks. This path is distinct from the general i18nextify design that intentionally renders HTML from translations — href/src schemes are narrow and attack-specific, and no legitimate translation needs `javascript:` or `data:`. The fix therefore blocks these schemes outright without changing other behaviour. ### Also fixed in 4.0.8 - **`debug` / `saveMissing` URL-


Mitigations:

Architectural layers (MAESTRO):