QID 983937

Affected versions of `i18next` may fail to sanitize user input when certain configuration options are used. When using the `.init` method, passing interpolation options without passing an `escapeValue` will default to `undefined` rather than the assumed `true`. ## Proof of Concept ``` var init = i18n.init({ interpolation: { prefix: "__", suffix: "__", escapeValue: true } }, function(){ var test = i18n.t('__firstName__ __lastName__', { firstName: 'Bob', lastName: '["foo","bar"]', }); console.log(test); }); ``` When `escapeValue` is explicitly passed, the result of `test` is: ``` &lt;script&gt;alert(1)&lt;&#x2F;script&gt; Johnson ``` This is supposed to be the default. However, if `escapeValue` is not included, the result is the unescaped string: ``` <SCRIPT>alert(1)</SCRIPT> Johnson ``` ## Recommendation Update to version 3.4.4 or later.

Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.