{"action":"Upgrade i18nextify to 4.0.8 or later.","affected":[{"fixed":"4.0.8","introduced":"0"}],"component":"i18nextify","cve_ids":["CVE-2026-41692"],"ecosystem":"npm","epss":0.00144,"exploited":false,"fixed_versions":["4.0.8"],"ghsa_id":"GHSA-6457-mxpq-4fqq","id":"tcs_01M5KF5DYTQ37WD37X292A1Y2W","modified_at":"2026-05-11T13:53:13.645066Z","published_at":"2026-04-22T17:42:24Z","references":["https://osv.dev/vulnerability/GHSA-6457-mxpq-4fqq","https://github.com/i18next/i18nextify/security/advisories/GHSA-6457-mxpq-4fqq","https://nvd.nist.gov/vuln/detail/CVE-2026-41692","https://github.com/i18next/i18nextify/commit/16f23dbcdcf893673587f7a03355bf7ce0a0e49e","https://github.com/i18next/i18nextify"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"GHSA-6457-mxpq-4fqq","url":"https://osv.dev/vulnerability/GHSA-6457-mxpq-4fqq"}],"summary":"i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes"}