Vulnerability-Lookup

GHSA-MGCP-MFP8-3Q45

Vulnerability from github – Published: 2026-04-22 20:28 – Updated: 2026-05-13 13:30

Summary

i18next-locize-backend has URL Injection via Unsanitized Path Parameters

Details

Summary

Versions of i18next-locize-backend prior to 9.0.2 interpolate lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath / getLanguagesPath URL templates with no path-component validation and no encoding. When an application exposes any of these values to user-controlled input (?lng= / ?ns= query parameters via i18next-browser-languagedetector, cookies, request headers, or a URL-derived projectId), a crafted value can change the structure of the outgoing request URL.

Affected call sites in lib/index.js (pre-patch): the interpolate() helper is used at the five URL-build sites — _readAny/read (line 415 for private, 426 for public), getLanguages (lines 271 and 296), and writePage (lines 616 and 622) for the missing-key and update POST paths. The helper interpolate in lib/utils.js substitutes raw values with no encoding.

Impact

An attacker who can influence lng, ns, projectId, or version can:

Path traversal — lng = '../../admin' against https://api.locize.app/{{projectId}}/{{version}}/{{lng}}/{{ns}} changes the request URL path segment that reaches the locize CDN / API.
Query-string injection — lng = 'en?x=y' appends an attacker-chosen query to the URL.
Fragment truncation — lng = 'en#x' silently truncates the path in browser fetches.
URL-encoded bypass — lng = 'en%2F..' leverages server-side decoding to reintroduce /...

The worst-case concrete impact is loading an unintended translation resource (potentially causing wrong content to render) and, when a custom loadPath is configured against an internal / file-scheme URL, SSRF or arbitrary-file read on the host running the backend.

Additionally, the pre-patch interpolate() function read data[key] without excluding prototype-chain properties — under prototype-pollution conditions in the same process, that path could pull values from Object.prototype into the URL.

Related fixes shipped in 9.0.2

The defaults() helper replaces for...in iteration with Object.keys() plus an explicit prototype-key guard so a polluted Object.prototype cannot leak into the merged options object.
New utils.interpolateUrl / isSafeUrlSegment / sanitizeLogValue / redactUrlCredentials helpers mirror the pattern shipped in i18next-http-backend@3.0.5 (see its advisory GHSA-q89c-q3h5-w34g).

Affected versions

All versions of i18next-locize-backend prior to 9.0.2.

Patch

Fixed in 9.0.2. lib/index.js now uses interpolateUrl() at every URL-build site and returns an error callback (or silently drops the queued write for writePage) when any interpolated value fails the safety check. Legitimate i18next language-code shapes (BCP-47, en_US, zh-Hant-HK, my-custom.ns, +-joined multi-language values) all pass.

Workarounds

No workaround short of upgrading. If you cannot upgrade immediately, sanitise lng / ns / projectId / version at your application boundary before passing them through to i18next — reject values containing .., /, \, ?, #, %, whitespace, control characters, and cap the length.

Credits

Discovered via an internal security audit of the i18next / locize ecosystem.

References

CWE-22: Path Traversal
CWE-74: Injection
CWE-1321: Prototype Pollution (amplification path)
Related advisory in the same ecosystem: GHSA-q89c-q3h5-w34g (i18next-http-backend)

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "i18next-locize-backend"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41885"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-74"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-22T20:28:27Z",
    "nvd_published_at": "2026-05-08T16:16:11Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nVersions of `i18next-locize-backend` prior to 9.0.2 interpolate `lng`, `ns`, `projectId`, and `version` directly into the configured `loadPath` / `privatePath` / `addPath` / `updatePath` / `getLanguagesPath` URL templates with no path-component validation and no encoding. When an application exposes any of these values to user-controlled input (`?lng=` / `?ns=` query parameters via `i18next-browser-languagedetector`, cookies, request headers, or a URL-derived `projectId`), a crafted value can change the structure of the outgoing request URL.\n\nAffected call sites in `lib/index.js` (pre-patch): the `interpolate()` helper is used at the five URL-build sites \u2014 `_readAny`/`read` (line 415 for private, 426 for public), `getLanguages` (lines 271 and 296), and `writePage` (lines 616 and 622) for the missing-key and update POST paths. The helper `interpolate` in `lib/utils.js` substitutes raw values with no encoding.\n\n### Impact\n\nAn attacker who can influence `lng`, `ns`, `projectId`, or `version` can:\n\n- **Path traversal** \u2014 `lng = \u0027../../admin\u0027` against `https://api.locize.app/{{projectId}}/{{version}}/{{lng}}/{{ns}}` changes the request URL path segment that reaches the locize CDN / API.\n- **Query-string injection** \u2014 `lng = \u0027en?x=y\u0027` appends an attacker-chosen query to the URL.\n- **Fragment truncation** \u2014 `lng = \u0027en#x\u0027` silently truncates the path in browser fetches.\n- **URL-encoded bypass** \u2014 `lng = \u0027en%2F..\u0027` leverages server-side decoding to reintroduce `/..`.\n\nThe worst-case concrete impact is loading an unintended translation resource (potentially causing wrong content to render) and, when a custom `loadPath` is configured against an internal / file-scheme URL, **SSRF or arbitrary-file read** on the host running the backend.\n\nAdditionally, the pre-patch `interpolate()` function read `data[key]` without excluding prototype-chain properties \u2014 under prototype-pollution conditions in the same process, that path could pull values from `Object.prototype` into the URL.\n\n### Related fixes shipped in 9.0.2\n\n- The `defaults()` helper replaces `for...in` iteration with `Object.keys()` plus an explicit prototype-key guard so a polluted `Object.prototype` cannot leak into the merged options object.\n- New `utils.interpolateUrl` / `isSafeUrlSegment` / `sanitizeLogValue` / `redactUrlCredentials` helpers mirror the pattern shipped in `i18next-http-backend@3.0.5` (see its advisory [GHSA-q89c-q3h5-w34g](https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g)).\n\n### Affected versions\n\nAll versions of `i18next-locize-backend` prior to **9.0.2**.\n\n### Patch\n\nFixed in **9.0.2**. `lib/index.js` now uses `interpolateUrl()` at every URL-build site and returns an error callback (or silently drops the queued write for `writePage`) when any interpolated value fails the safety check. Legitimate i18next language-code shapes (BCP-47, `en_US`, `zh-Hant-HK`, `my-custom.ns`, `+`-joined multi-language values) all pass.\n\n### Workarounds\n\nNo workaround short of upgrading. If you cannot upgrade immediately, sanitise `lng` / `ns` / `projectId` / `version` at your application boundary before passing them through to i18next \u2014 reject values containing `..`, `/`, `\\`, `?`, `#`, `%`, whitespace, control characters, and cap the length.\n\n### Credits\n\nDiscovered via an internal security audit of the i18next / locize ecosystem.\n\n### References\n\n- [CWE-22: Path Traversal](https://cwe.mitre.org/data/definitions/22.html)\n- [CWE-74: Injection](https://cwe.mitre.org/data/definitions/74.html)\n- [CWE-1321: Prototype Pollution (amplification path)](https://cwe.mitre.org/data/definitions/1321.html)\n- Related advisory in the same ecosystem: [GHSA-q89c-q3h5-w34g (i18next-http-backend)](https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g)",
  "id": "GHSA-mgcp-mfp8-3q45",
  "modified": "2026-05-13T13:30:05Z",
  "published": "2026-04-22T20:28:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/locize/i18next-locize-backend/security/advisories/GHSA-mgcp-mfp8-3q45"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41885"
    },
    {
      "type": "WEB",
      "url": "https://github.com/locize/i18next-locize-backend/commit/8f81ad4707aa0e90647fde4da5fbe5b23153c6e1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/locize/i18next-locize-backend"
    },
    {
      "type": "WEB",
      "url": "https://github.com/locize/i18next-locize-backend/releases/tag/v9.0.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "i18next-locize-backend has URL Injection via Unsanitized Path Parameters"
}

CVE-2026-41885 (GCVE-0-2026-41885)

Vulnerability from cvelistv5 – Published: 2026-05-08 15:41 – Updated: 2026-05-08 16:06

Title

Path traversal / URL injection via unsanitised lng/ns/projectId/version in i18next-locize-backend

Summary

i18next-locize-backend is a simple i18next backend for locize.com which can be used in Node.js, in the browser and for Deno. Prior to version 9.0.2, i18next-locize-backend interpolates lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath / getLanguagesPath URL templates with no path-component validation and no encoding. When an application exposes any of these values to user-controlled input (?lng= / ?ns= query parameters via i18next-browser-languagedetector, cookies, request headers, or a URL-derived projectId), a crafted value can change the structure of the outgoing request URL. Affected call sites in lib/index.js (pre-patch): the interpolate() helper is used at the five URL-build sites — _readAny/read (line 415 for private, 426 for public), getLanguages (lines 271 and 296), and writePage (lines 616 and 622) for the missing-key and update POST paths. The helper interpolate in lib/utils.js substitutes raw values with no encoding. This issue has been patched in version 9.0.2.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-08 16:06 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/locize/i18next-locize-backend/…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
locize	i18next-locize-backend	Affected: < 9.0.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41885",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-08T16:06:00.435386Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-08T16:06:11.177Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "i18next-locize-backend",
          "vendor": "locize",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "i18next-locize-backend is a simple i18next backend for locize.com which can be used in Node.js, in the browser and for Deno. Prior to version 9.0.2, i18next-locize-backend interpolates lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath / getLanguagesPath URL templates with no path-component validation and no encoding. When an application exposes any of these values to user-controlled input (?lng= / ?ns= query parameters via i18next-browser-languagedetector, cookies, request headers, or a URL-derived projectId), a crafted value can change the structure of the outgoing request URL. Affected call sites in lib/index.js (pre-patch): the interpolate() helper is used at the five URL-build sites \u2014 _readAny/read (line 415 for private, 426 for public), getLanguages (lines 271 and 296), and writePage (lines 616 and 622) for the missing-key and update POST paths. The helper interpolate in lib/utils.js substitutes raw values with no encoding. This issue has been patched in version 9.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-08T15:41:14.065Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/locize/i18next-locize-backend/security/advisories/GHSA-mgcp-mfp8-3q45",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/locize/i18next-locize-backend/security/advisories/GHSA-mgcp-mfp8-3q45"
        }
      ],
      "source": {
        "advisory": "GHSA-mgcp-mfp8-3q45",
        "discovery": "UNKNOWN"
      },
      "title": "Path traversal / URL injection via unsanitised lng/ns/projectId/version in i18next-locize-backend"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41885",
    "datePublished": "2026-05-08T15:41:14.065Z",
    "dateReserved": "2026-04-22T15:11:54.670Z",
    "dateUpdated": "2026-05-08T16:06:11.177Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-MGCP-MFP8-3Q45

Summary

Impact

Related fixes shipped in 9.0.2

Affected versions

Patch

Workarounds

Credits

References

CVE-2026-41885 (GCVE-0-2026-41885)

Tags

Sightings

Nomenclature

Related by attack behaviour