Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact i18next-fs-backend ≤ 2.6.5, when used to persist missing translation keys (e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input), is vulnerable to prototype pollution via crafted missing-key strings. Backend.writeFile() splits each queued missing-key string on the configured keySeparator (default .) before calling the internal setPath() walker. The walker (getLastOfPath in lib/utils.js) did not guard against unsafe segments, so a key like "proto.polluted" was split into ["proto", "polluted"] and walked straight into Object.prototype, allowing an attacker to write arbitrary properties onto the global object prototype. Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks. Affected configuration Applications are directly affected only if all of the following hold: - i18next-fs-backend ≤ 2.6.5 is configured as the…
Recommended action: Upgrade to 2.6.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of i18next-fs-backend prior to 2.6.4 interpolate the caller-supplied lng and ns values directly into the configured loadPath and addPath templates with no path-component validation and no sanitisation. When an application exposes the resolved language code to user-controlled input (?lng= query parameter, cookie, request header), a crafted value can break out of the intended locale directory. Affected call sites in lib/index.js: - read (line 38 pre-patch): const filename = interpolate(loadPath, { lng: language, ns: namespace }) - removeFile (line 101 pre-patch): same pattern against addPath - writeFile (line 127 pre-patch): same pattern against addPath for queued missing-key writes The helper interpolate in lib/utils.js substitutes raw values with no encoding — unlike the addQueryString helper in i18next-http-backend, there is no equivalent safety for path interpolation. Impact - Arbitrary file read. With a loadPath like /locales/{{lng}}/{{ns}}.json, an…
Recommended action: Upgrade to 2.6.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.