CVE-2026-41885 Details
Description
i18next-locize-backend is a simple i18next backend for locize.com which can be used in Node.js, in the browser and for Deno. Prior to version 9.0.2, i18next-locize-backend interpolates lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath / getLanguagesPath URL templates with no path-component validation and no encoding. When an application exposes any of these values to user-controlled input (?lng= / ?ns= query parameters via i18next-browser-languagedetector, cookies, request headers, or a URL-derived projectId), a crafted value can change the structure of the outgoing request URL. Affected call sites in lib/index.js (pre-patch): the interpolate() helper is used at the five URL-build sites — _readAny/read (line 415 for private, 426 for public), getLanguages (lines 271 and 296), and writePage (lines 616 and 622) for the missing-key and update POST paths. The helper interpolate in lib/utils.js substitutes raw values with no encoding. This issue has been patched in version 9.0.2.
A path traversal and URL injection vulnerability exists in i18next-locize-backend versions prior to 9.0.2. The issue arises because the backend interpolates language, namespace, project ID, and version directly into the URL templates for various paths without proper validation or encoding. This flaw allows an attacker to manipulate the request URL structure by exploiting user-controlled input, such as query parameters, cookies, request headers, or derived project IDs. The vulnerability could lead to unintended resource loading, potentially causing incorrect content to be displayed, or, in cases where a custom load path is set to an internal or file-scheme URL, server-side request forgery or arbitrary file reading on the host running the backend.
Users are advised to upgrade to i18next-locize-backend version 9.0.2 or later. If an immediate upgrade is not possible, sanitize the 'lng', 'ns', 'projectId', and 'version' values at the application level before passing them to i18next. Reject any values containing path traversal sequences, control characters, or certain URL-encoded characters, and limit the length of these inputs.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 8, 2026CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/locize/i18next-locize-backend/security/advisories/GHSA-mgcp-mfp8-3q45 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| locize i18next-locize-backend | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |