4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41692

CVE-2026-41692: i18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributes

i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (the replaceInside handler) only guards against a duplicated http:// origin prefix — it does not validate the URL scheme of the substituted value. A translated value such as javascript:alert(1) or data:text/html,<script>...</script> is applied unchanged to the live DOM attribute when an attacker can influence the content of a translation file or the translation-backend response — for example, via a compromised translation CDN, user-contributed locales, a MITM on a plain-HTTP backend, or write access to the translation JSON. This issue was patched in version 4.0.8.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41692

CVE-2026-41692:

4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
i18nextify	npm	< 4.0.8	4.0.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the i18nextify library, specifically in how it handles translations within href and src attributes. The core of the issue lies in the translateProps function in src/localize.js. This function, prior to the patch, would substitute translation placeholders with their corresponding values without any sanitization of the URL schemes. This allowed an attacker who could control the translation values to inject malicious URLs using schemes like javascript: or data:, leading to a DOM-based Cross-Site Scripting (XSS) vulnerability. The patch addresses this by introducing a new function, isDangerousUrl, which checks for and blocks these malicious schemes. The translateProps function was updated to use this check and replace any dangerous URLs with an empty string, effectively neutralizing the threat. The walk function, which is also in src/localize.js and is responsible for traversing the DOM and calling translateProps, was also updated to include an optional sanitization hook, providing a secondary layer of defense.

Vulnerable functions

translateProps

src/localize.js

The `translateProps` function in `src/localize.js` is responsible for substituting translation keys in attributes. Before the patch, it did not validate the URL scheme of the substituted value, allowing malicious schemes like `javascript:` or `data:` to be injected into `href` and `src` attributes, leading to a DOM-based XSS vulnerability. The patch introduces a check to block these dangerous URL schemes.

walk

src/localize.js

The `walk` function traverses the DOM and initiates the translation process. It was modified to include an optional `sanitize` hook as a defense-in-depth measure. While not the primary vulnerable function, it is part of the execution flow that leads to the vulnerability and was patched to provide an additional layer of security.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.