The vulnerability in i18nextify versions before 4.0.8 involves improper neutralization of input during web page generation (CWE-79). Specifically, the library replaces {{key}} tokens in src and href attributes with raw translation strings without validating the URL scheme. An attacker able to control translation content—via compromised translation CDN, user-contributed locales, MITM on HTTP backend, or write access to translation JSON—can inject malicious URLs like javascript:alert(1) or data:text/html,<script>...</script>. This leads to cross-site scripting when the malicious URL is applied to live DOM attributes. The issue was patched in version 4.0.8.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected website, potentially leading to data theft, session hijacking, or other client-side attacks. The impact is limited to confidentiality and integrity with no direct availability impact. The CVSS score is 4.7 (medium severity) with network attack vector, high attack complexity, no privileges required, user interaction required, and scope changed.

A fix is available in i18nextify version 4.0.8. Users should upgrade to version 4.0.8 or later to remediate this vulnerability. Until upgraded, avoid using untrusted or user-contributed translation content and ensure translation backends are secured against tampering. Patch status is confirmed by the vendor advisory indicating the issue was fixed in version 4.0.8.