{
  "@id": "urn:uuid:30a2514f-01a7-423c-8dac-301754ed8a49",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T00:40:25.726458+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/i18next@23.16.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/i18next@23.16.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability AIKIDO-2024-10543 is fixed in version 23.16.8-tuxcare.2 of i18next.",
      "vulnerability": {
        "name": "AIKIDO-2024-10543"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/i18next@23.16.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/i18next@23.16.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T00:40:25.726458+00:00",
      "status_notes": "Vulnerability CVE-2017-16008 does not affect version 23.16.8-tuxcare.2 of i18next. not_affected \u2014 CVE-2017-16008 describes a cross-site scripting vulnerability in i18next versions < 1.10.3 where user-provided translation option values containing key reference patterns (e.g., `firstName: '__lastNameHTML__'`) would be recursively substituted before escaping, allowing XSS. The target version 23.16.8-tuxcare.4 is not affected. The vulnerability was fixed in upstream commit 34e8e13a (October 201...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-16008"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-16008 describes a cross-site scripting vulnerability in i18next versions < 1.10.3 where user-provided translation option values containing key reference patterns (e.g., `firstName: '__lastNameHTML__'`) would be recursively substituted before escaping, allowing XSS. The target version 23.16.8-tuxcare.4 is not affected. The vulnerability was fixed in upstream commit 34e8e13a (October 201..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/i18next@23.16.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/i18next@23.16.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T00:38:46.086729+00:00",
      "status_notes": "Vulnerability CVE-2017-16010 does not affect version 23.16.8-tuxcare.2 of i18next. not_affected \u2014 CVE-2017-16010 is NOT present in i18next version 23.16.8. The vulnerability required that interpolation.escapeValue defaults to undefined instead of true, allowing XSS via unescaped user input. The fix (commit d367309d, Oct 13, 2016, by amchardy@shutterstock.com) that ensures escapeValue defaults to true was already in the upstream release when TuxCare onboarded this version. Current code has t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-16010"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-16010 is NOT present in i18next version 23.16.8. The vulnerability required that interpolation.escapeValue defaults to undefined instead of true, allowing XSS via unescaped user input. The fix (commit d367309d, Oct 13, 2016, by amchardy@shutterstock.com) that ensures escapeValue defaults to true was already in the upstream release when TuxCare onboarded this version. Current code has t..."
    }
  ]
}