CVE-2026-41886
locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor
Impact
locize is a localization platform that connects code and i18n setup. Prior to version 4.0.21, the locize client SDK registers a window.addEventListener("message", …) handler that dispatches to registered internal handlers (editKey, commitKey, commitKeys, isLocizeEnabled, requestInitialize, …) without validating event.origin. The pre-patch listener in src/api/postMessage.js gates dispatch on event.data.sender === "i18next-editor-frame" — that value sits inside the attacker-controlled message payload, not the browser-enforced origin. Any web page that could embed or be embedded by a locize-enabled host — an iframe on a third-party page, a window.open-ed victim, a parent frame reaching down — could send a crafted postMessage and trigger the internal handlers. This issue has been patched in version 4.0.21.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | locize | < 4.0.21 | 4.0.21 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-w937-fg2h-xhq2
- https://github.com/locize/locize/security/advisories/GHSA-w937-fg2h-xhq2
- https://github.com/locize/locize/commit/d006b75fadb8e8ab77b023e462850fc6e9170735
- https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage#security_concerns
- https://github.com/locize/locize/releases/tag/v4.0.21
- https://nvd.nist.gov/vuln/detail/CVE-2026-41886