CVE-2026-41885: i18next-locize-backend has URL Injection via Unsanitized Path Parameters
(updated )
Versions of i18next-locize-backend prior to 9.0.2 interpolate lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath / getLanguagesPath URL templates with no path-component validation and no encoding. When an application exposes any of these values to user-controlled input (?lng= / ?ns= query parameters via i18next-browser-languagedetector, cookies, request headers, or a URL-derived projectId), a crafted value can change the structure of the outgoing request URL.
Affected call sites in lib/index.js (pre-patch): the interpolate() helper is used at the five URL-build sites — _readAny/read (line 415 for private, 426 for public), getLanguages (lines 271 and 296), and writePage (lines 616 and 622) for the missing-key and update POST paths. The helper interpolate in lib/utils.js substitutes raw values with no encoding.
References
- github.com/advisories/GHSA-mgcp-mfp8-3q45
- github.com/locize/i18next-locize-backend
- github.com/locize/i18next-locize-backend/commit/8f81ad4707aa0e90647fde4da5fbe5b23153c6e1
- github.com/locize/i18next-locize-backend/releases/tag/v9.0.2
- github.com/locize/i18next-locize-backend/security/advisories/GHSA-mgcp-mfp8-3q45
- nvd.nist.gov/vuln/detail/CVE-2026-41885
Code Behaviors & Features
Detect and mitigate CVE-2026-41885 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →