This security bulletin contains one medium risk vulnerability.
Exploit availability: NoDescription
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to improper input validation in the "AddResourceBundle" API which uses the "deepExtend" function. A remote attacker can overwrite and pollute the object prototype of a program.Mitigation
Install updates from vendor's website.Vulnerable software versions
i18next: 1.6.0 - 19.5.6
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?