Vulnerability	Vulnerable Version
M Modification of Assumed-Immutable Data (MAID) i18next is an internationalization framework for browser or any other javascript environment (eg. node.js). Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data (MAID) via the `deepExtend` function in `src/utils.js`, which uses the `in` operator to check for property existence on the target object. Because the `in` operator traverses the prototype chain, an attacker who can supply a malicious resource bundle containing a property named `hasOwnProperty` can overwrite `Object.prototype.hasOwnProperty`, causing process-wide corruption of that built-in and crashing any subsequent code that relies on it. Note: This is only exploitable when `deepExtend` is invoked with deep merging enabled, such as through `addResourceBundle` with the `deep` parameter set to `true`. How to fix Modification of Assumed-Immutable Data (MAID)? Upgrade `i18next` to version 26.3.4 or higher.	<26.3.4

Modification of Assumed-Immutable Data (MAID)

i18next is an internationalization framework for browser or any other javascript environment (eg. node.js).

Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data (MAID) via the deepExtend function in src/utils.js, which uses the in operator to check for property existence on the target object. Because the in operator traverses the prototype chain, an attacker who can supply a malicious resource bundle containing a property named hasOwnProperty can overwrite Object.prototype.hasOwnProperty, causing process-wide corruption of that built-in and crashing any subsequent code that relies on it.

Note: This is only exploitable when deepExtend is invoked with deep merging enabled, such as through addResourceBundle with the deep parameter set to true.

How to fix Modification of Assumed-Immutable Data (MAID)?

Upgrade i18next to version 26.3.4 or higher.

<26.3.4

Go back to all versions of this package