What’s Vulnerable › Vulnerabilities

CVE-2017-16008

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-06-04 · updated 2026-06-17
• Weakness: CWE-79

Description

i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted user input can use the name of one of the dictionary keys to inject script into the browser. This affects i18next <=1.10.2.

Affected products

• HackerOne i18next node module: through 1.10.2

References

• https://github.com/i18next/i18next/pull/443
• https://nodesecurity.io/advisories/325
• https://github.com/i18next/i18next/pull/443
• https://nodesecurity.io/advisories/325

Get alerted when CVE-2017-16008 or the next vulnerability affects your stack