The vulnerability in i18nextify (versions before 4.0.8) involves improper neutralization of input during web page generation, specifically in the substitution of {{key}} tokens inside src and href attributes. The replacement logic fails to validate the URL scheme of the translated string, allowing potentially dangerous schemes like javascript: or data: to be injected if an attacker can control translation content. This can occur through compromised translation CDNs, user-contributed locales, MITM attacks on plain HTTP backends, or write access to translation JSON files. The issue was patched in version 4.0.8 to prevent such unsafe substitutions.

An attacker able to influence translation content can inject malicious URLs into src or href attributes, leading to cross-site scripting attacks. This can result in limited confidentiality and integrity impacts by executing arbitrary scripts in the context of the affected website. The CVSS 3.1 base score is 4.7 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

This vulnerability is fixed in i18nextify version 4.0.8. Users should upgrade to version 4.0.8 or later to remediate this issue. If upgrading is not immediately possible, ensure that translation content sources are fully trusted and protected against unauthorized modification, and avoid using untrusted translation backends or CDNs. Patch status is not explicitly stated in the vendor advisory, but the description confirms the issue was patched in 4.0.8.