ID:12849 - Exploit for Modification of assumed-immutable data in i18next - CVE-2026-63402

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to application does not perform validation of the attacker-controlled data, assuming that data is valid and safe within deepExtend in src/utils.js. A remote user can perform a denial of service (DoS) attack.

Remediation