The flaw allows an attacker to inject arbitrary JavaScript into a page by manipulating translation files that the i18nextify library loads. Because the library replaces {{key}} tokens in src and href attributes with the raw translation string without validating the URL scheme, crafted values such as javascript:alert(1) or data:text/html,<script>...</script> are written directly to the DOM, enabling malicious payload execution in the context of the page and leading to classic cross‑site scripting attacks.

Vendor i18next’s i18nextify library is affected. All releases before version 4.0.8 are vulnerable; upgrading to 4.0.8 or later removes the flaw.

With a CVSS score of 4.7 the vulnerability is of moderate severity, but the lack of a scheme check gives an attacker the ability to run any JavaScript if they can influence the translation source. Exploitation requires control over the translation JSON, the translation CDN, or a plain‑HTTP backend that can be MITMed. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, yet the potential impact remains that an attacker could deface a page or steal credentials from users if the library is used on a public website.