PT-2026-37155 · Npm · I18Next-Locize-Backend
CVE-2026-41885
·
Published
2026-04-22
·
Updated
2026-05-08
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
i18next-locize-backend versions prior to 9.0.2
Description
The software interpolates
lng, ns, projectId, and version directly into configured URL templates such as 'loadPath', 'privatePath', 'addPath', 'updatePath', and 'getLanguagesPath' without path-component validation or encoding. When these values are exposed to user-controlled input—such as query parameters via i18next-browser-languagedetector, cookies, request headers, or a URL-derived projectId—a crafted value can alter the structure of the outgoing request URL. This can lead to path traversal, query-string injection, or fragment truncation. In cases where a custom 'loadPath' is configured against an internal or file-scheme URL, this may result in Server-Side Request Forgery (SSRF) or arbitrary-file read on the host. Additionally, the interpolate() function in lib/utils.js reads data[key] without excluding prototype-chain properties, which could allow values from Object.prototype to be pulled into the URL under prototype pollution conditions. The issue involves the interpolate() helper used in lib/index.js within the readAny(), read(), getLanguages(), and writePage() functions.Recommendations
Update to version 9.0.2.
As a temporary mitigation, sanitize
lng, ns, projectId, and version at the application boundary by rejecting values containing .., /, ``, ?, #, %, whitespace, or control characters, and by capping the length of these inputs.Exploit
Fix
Special Elements Injection
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
I18Next-Locize-Backend