An origin validation vulnerability in the locize localization platform affects versions prior to 4.0.21, exposing host applications to unauthorized actions and cross-site scripting risks.

This is an origin validation error classified under CWE-346 and CWE-79, where the locize client SDK registers a message event listener without validating event.origin. Unauthenticated attackers require user interaction to exploit this flaw via crafted postMessage payloads from third-party sites.

Successful exploitation can lead to unauthorized actions within the context of the user session, potentially compromising user data and application integrity. With a CVSS score of 7.5, this high-severity vulnerability warrants immediate attention to prevent malicious manipulation of localization workflows.

Immediate Action: Update the locize npm package to version 4.0.21 or later.

Proactive Monitoring: Monitor web application error logs and network traffic for anomalous postMessage payloads targeting localization endpoints.

Compensating Controls: Implement strict Content Security Policy directives to restrict frame embedding and message communication origins.

Public Exploit Available: No - As of May 10, 2026, there is no confirmed public exploit available in the provided data.

This high-severity vulnerability poses significant risks to applications utilizing affected versions of the locize client SDK. Administrators and developers must apply the vendor-supplied update to version 4.0.21 immediately to eliminate the underlying origin validation flaw and secure client-side communication channels.