Hackerone I18Next Node Module vulnerabilities

2 vulnerabilities

Known vulnerabilities in Hackerone I18Next Node Module, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.1CVE-2017-16010hackeronei18next node module+2
EPSS score
1.00%
i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. This can result in a cross-site scripting vulnerability because user input is assumed to be escaped, but is not. This vulnerability affects i18next 2.0.0 and later.6.1CVE-2017-16008hackeronei18next node module+2
EPSS score
0.85%
i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted user input can use the name of one of the dictionary keys to inject script into the browser. This affects i18next <=1.10.2.