PT-2026-37155 · Npm · I18Next-Locize-Backend

Published

2026-04-22

·

Updated

2026-05-08

·

CVE-2026-41885

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions i18next-locize-backend versions prior to 9.0.2
Description The software interpolates lng, ns, projectId, and version directly into configured URL templates such as 'loadPath', 'privatePath', 'addPath', 'updatePath', and 'getLanguagesPath' without path-component validation or encoding. When these values are exposed to user-controlled input—such as query parameters via i18next-browser-languagedetector, cookies, request headers, or a URL-derived projectId—a crafted value can alter the structure of the outgoing request URL. This can lead to path traversal, query-string injection, or fragment truncation. In cases where a custom 'loadPath' is configured against an internal or file-scheme URL, this may result in Server-Side Request Forgery (SSRF) or arbitrary-file read on the host. Additionally, the interpolate() function in lib/utils.js reads data[key] without excluding prototype-chain properties, which could allow values from Object.prototype to be pulled into the URL under prototype pollution conditions. The issue involves the interpolate() helper used in lib/index.js within the readAny(), read(), getLanguages(), and writePage() functions.
Recommendations Update to version 9.0.2. As a temporary mitigation, sanitize lng, ns, projectId, and version at the application boundary by rejecting values containing .., /, ``, ?, #, %, whitespace, or control characters, and by capping the length of these inputs.

Fix

Path traversal

Special Elements Injection

Weakness Enumeration

Related Identifiers

CVE-2026-41885
GHSA-MGCP-MFP8-3Q45

Affected Products

I18Next-Locize-Backend