CVE-2026-41885: i18next-locize-backend has URL Injection via Unsanitized Path Parameters
(updated )
Versions of i18next-locize-backend prior to 9.0.2 interpolate lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath / getLanguagesPath URL templates with no path-component validation and no encoding. When an application exposes any of these values to user-controlled input (?lng= / ?ns= query parameters via i18next-browser-languagedetector, cookies, request headers, or a URL-derived projectId), a crafted value can change the structure of the outgoing request URL.
Affected call sites in lib/index.js (pre-patch): the interpolate() helper is used at the five URL-build sites — _readAny/read (line 415 for private, 426 for public), getLanguages (lines 271 and 296), and writePage (lines 616 and 622) for the missing-key and update POST paths. The helper interpolate in lib/utils.js substitutes raw values with no encoding.
References
- github.com/advisories/GHSA-mgcp-mfp8-3q45
- github.com/locize/i18next-locize-backend/commit/8f81ad4707aa0e90647fde4da5fbe5b23153c6e1
- github.com/locize/i18next-locize-backend/releases/tag/v9.0.2
- github.com/locize/i18next-locize-backend/security/advisories/GHSA-mgcp-mfp8-3q45
- nvd.nist.gov/vuln/detail/CVE-2026-41885
Code Behaviors & Features
Detect and mitigate CVE-2026-41885 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →