npm/locize CVE-2026-41886: high 7.5, EPSS 0.10%
locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor
Action: Upgrade locize to 4.0.21 or later.
npm i locize@4.0.21Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.0.21 | - |
Fixed versions
| 4.0.21 |
Sources
- osv: GHSA-w937-fg2h-xhq2
- https://github.com/locize/locize/security/advisories/GHSA-w937-fg2h-xhq2
- https://nvd.nist.gov/vuln/detail/CVE-2026-41886
- https://github.com/locize/locize/commit/d006b75fadb8e8ab77b023e462850fc6e9170735
- https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage#security_concerns
- https://github.com/locize/locize
- https://github.com/locize/locize/releases/tag/v4.0.21
CVE-2026-41886 · published · modified · JSON