Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

i18next-locize-backend

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5npmAmendedPublished

    i18next-locize-backend has URL Injection via Unsanitized Path Parameters

    CVE-2026-41885 · GHSA-mgcp-mfp8-3q45

    Affected
    • npm i18next-locize-backend < 9.0.2
    Fixed in
    9.0.2· Vendor fix available
    Issue
    Versions of i18next-locize-backend prior to 9.0.2 interpolate lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath / getLanguagesPath URL templates with no path-component validation and no encoding. When an application exposes any of these values to user-controlled input (?lng= / ?ns= query parameters via i18next-browser-languagedetector, cookies, request headers, or a URL-derived projectId), a crafted value can change the structure of the outgoing request URL. Affected call sites in lib/index.js (pre-patch): the interpolate() helper is used at the five URL-build sites — readAny/read (line 415 for private, 426 for public), getLanguages (lines 271 and 296), and writePage (lines 616 and 622) for the missing-key and update POST paths. The helper interpolate in lib/utils.js substitutes raw values with no encoding. Impact An attacker who can influence lng, ns, projectId, or version can: - Path traversal — lng = '../../admin'…

    Recommended action: Upgrade to 9.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →