Skip to content
Threat Feed

Vendor

Locize

1 brief RSS
high advisory

locize Client SDK Cross-Origin DOM XSS and Handler Hijack Vulnerability

The locize client SDK versions prior to 4.0.21 are vulnerable to cross-origin DOM XSS and handler hijack due to missing origin validation in the InContext Editor, allowing attackers to inject malicious code and exfiltrate data via crafted postMessage events.

locize client SDK xss dom-xss postMessage locize javascript
2r 1t