{"id":"CVE-2026-41691","revision":null,"records":[{"revision":"967b1bff1ad044c2ba607bc5b9762edb","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-41691","aliases":[],"title":"i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns","description":"Copilot said: i18nextify is a JavaScript library that adds\ni18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 3.0.5 interpolate the lng and ns values directly into the configured loadPath / addPath URL template without any encoding, validation, or path sanitisation. When an application exposes the language-code selection to user-controlled input (the default — i18next-browser-languagedetector reads ?lng= query params, cookies, localStorage, and request headers), an attacker can inject characters that change the structure of the outgoing request URL. This is a single URL-injection vulnerability. The attacker-controlled value is neutralised before it is used as part of an output URL string; the attack shape covers both path traversal and broader URL-structure injection — both are closed by the one interpolateUrl sanitisation fix. This issue has been fixed in version 3.0.5. If users cannot upgrade immediately, they can work around the issue by sanitising lng / ns before they reach i18next (strip .., /, \\, ?, #, %, whitespace, and control characters; cap the length).","state":0,"publishedAt":"2026-05-07T20:09:24.093+00:00","modifiedAt":"2026-05-08T13:08:58.684+00:00","affected":[{"ecosystem":"Vendor product","name":"i18next-http-backend","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"i18next\",\n                    \"product\": \"i18next-http-backend\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.0.5\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g","https://github.com/i18next/i18next-http-backend/commit/4cee84f229c637b9c182366d3156f726d407a621"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-41691","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-41691","identifiers":["CVE-2026-41691"]},"retained":false,"historicalAffected":[]},{"revision":"6b746b5166bd44a3be6d58295825a673","observedAt":"2026-11-01T07:10:42.874+00:00","statement":{"source":"euvd","id":"EUVD-2026-28438","aliases":["CVE-2026-41691"],"title":"Copilot said: i18nextify is a JavaScript library that adds","description":"Copilot said: i18nextify is a JavaScript library that adds\ni18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 3.0.5 interpolate the lng and ns values directly into the configured loadPath / addPath URL template without any encoding, validation, or path sanitisation. When an application exposes the language-code selection to user-controlled input (the default — i18next-browser-languagedetector reads ?lng= query params, cookies, localStorage, and request headers), an attacker can inject characters that change the structure of the outgoing request URL. This is a single URL-injection vulnerability. The attacker-controlled value is neutralised before it is used as part of an output URL string; the attack shape covers both path traversal and broader URL-structure injection — both are closed by the one interpolateUrl sanitisation fix. This issue has been fixed in version 3.0.5. If users cannot upgrade immediately, they can work around the issue by sanitising lng / ns before they reach i18next (strip .., /, \\, ?, #, %, whitespace, and control characters; cap the length).","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5,"severity":null}],"references":["https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g","https://github.com/i18next/i18next-http-backend/commit/4cee84f229c637b9c182366d3156f726d407a621"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28438","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 7, 2026, 8:09:24 PM","dateUpdated":"May 8, 2026, 1:08:58 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-28438","identifiers":["EUVD-2026-28438","CVE-2026-41691"]},"retained":false,"historicalAffected":[]},{"revision":"e69bde0856424b16b690a6ab7b4e0a3b","observedAt":"2026-10-27T10:10:19.004+00:00","statement":{"source":"nvd","id":"CVE-2026-41691","aliases":[],"title":"Copilot said: i18nextify is a JavaScript library that adds","description":"Copilot said: i18nextify is a JavaScript library that adds\ni18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 3.0.5 interpolate the lng and ns values directly into the configured loadPath / addPath URL template without any encoding, validation, or path sanitisation. When an application exposes the language-code selection to user-controlled input (the default — i18next-browser-languagedetector reads ?lng= query params, cookies, localStorage, and request headers), an attacker can inject characters that change the structure of the outgoing request URL. This is a single URL-injection vulnerability. The attacker-controlled value is neutralised before it is used as part of an output URL string; the attack shape covers both path traversal and broader URL-structure injection — both are closed by the one interpolateUrl sanitisation fix. This issue has been fixed in version 3.0.5. If users cannot upgrade immediately, they can work around the issue by sanitising lng / ns before they reach i18next (strip .., /, \\, ?, #, %, whitespace, and control characters; cap the length).","state":0,"publishedAt":"2026-05-07T21:16:29.56+00:00","modifiedAt":"2026-10-26T20:10:00.16+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1,"severity":"CRITICAL"}],"references":["https://github.com/i18next/i18next-http-backend/commit/4cee84f229c637b9c182366d3156f726d407a621","https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41691","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-22","CWE-74"],"productCriteria":["cpe:2.3:a:i18next:i18next-http-backend:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-05-07T21:16:29.560","lastModified":"2026-10-26T20:10:00.160"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-41691","identifiers":["CVE-2026-41691"]},"retained":false,"historicalAffected":[]},{"revision":"0aaa56f1e3d246cc81c83c0a8d98f178","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-q89c-q3h5-w34g","aliases":["CVE-2026-41691"],"title":" i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns","description":"### Summary\n\nVersions of `i18next-http-backend` prior to 3.0.5 interpolate the `lng` and `ns` values directly into the configured `loadPath` / `addPath` URL template without any encoding, validation, or path sanitisation. When an application exposes the language-code selection to user-controlled input (the default — `i18next-browser-languagedetector` reads `?lng=` query params, cookies, `localStorage`, and request headers), an attacker can inject characters that change the structure of the outgoing request URL.\n\nAffected call sites:\n\n- `_readAny` — `lib/index.js:64`: `interpolate(resolvedLoadPath, { lng: languages.join('+'), ns: namespaces.join('+') })`\n- `create` — `lib/index.js:123` (pre-patch): `interpolate(addPath, { lng, ns: namespace })`\n\nThe helper `interpolate` (`lib/utils.js`) previously returned the raw value with no encoding. In contrast, `addQueryString` already correctly uses `encodeURIComponent` for each query-string param — only the URL-path substitution was unprotected.\n\n### Impact\n\nAn attacker who can influence the resolved `lng` or `ns` value can alter the URL in several ways:\n\n- **Path traversal** — `lng = '../../config'` turns `/locales/{{lng}}/{{ns}}.json` into `/locales/../../config/translation.json`. On a misconfigured web server, this can cause the request to target a different resource than intended; in SSR pipelines that use `file://` or similar schemes for `loadPath`, it can read arbitrary files from the host filesystem.\n- **Query-string injection** — `lng = 'en?admin=true'` turns `/locales/{{lng}}/{{ns}}.json` into `/locales/en?admin=true/translation.json`. Some server frameworks parse the query portion with higher priority than the path and branch on attacker-controlled flags.\n- **Fragment truncation** — `lng = 'en#anything'` silently discards the rest of the path in browser fetches (client cannot see the final URL).\n- **URL-encoded bypasses** — `lng = 'en%2F..'`, after server-side URL decoding, resolves to `en/..` — the attacker bypasses the absence of a literal `/` in their input.\n\nThe practical worst case is **SSRF** when `loadPath` is an internal or file-scheme URL, and **path-based authorisation bypass** against servers that segment access by URL prefix.\n\n### Also fixed in 3.0.5\n\n- **Per-instance `omitFetchOptions`.** A module-level boolean in `lib/request.js` was flipped to `true` the first time any backend instance hit a \"not implemented\" fetch error. Once flipped, **all** subsequent requests from **all** backend instances in the same module silently stripped every user-configured fetch option — including security-relevant `credentials`, `mode`, and `cache`. One misbehaving instance (for example during SSR hydration or in React Native) permanently removed these protections process-wide. 3.0.5 scopes the flag to the backend's `options` object (`options._omitFetchOptions`) so one instance's fallback cannot pollute siblings.\n- **Log forging via control characters in `lng`/`ns`.** Error callbacks embedded the raw `lng`/`ns`/URL in the message string. Crafted CR/LF values could inject fake log lines into file-backed log aggregators (CWE-117). 3.0.5 strips C0/C1 control chars before concatenation.\n- **Basic-auth credentials leaked into error callbacks.** If `loadPath` contained a `user:password@host` authority, the full URL (including the credentials) ended up in the error message strings returned to the caller. 3.0.5 redacts `user:password@` before logging.\n- **Prototype-pollution amplification via `for...in`.** `addQueryString` and the XHR `customHeaders` loop used `for...in` which walks the prototype chain. Polluted `Object.prototype` entries could leak into URL query parameters and request headers. 3.0.5 uses `Object.keys` and an explicit prototype-key guard.\n\n### Affected versions\n\nAll versions of `i18next-http-backend` prior to **3.0.5**.\n\n### Patch\n\nFixed in **3.0.5**. Summary of the hardening:\n\n1. New `utils.interpolateUrl` (used by `_readAny` and `create`) returns `null` if any substitution fails the URL-segment safety check (blocks `..`, `/`, `\\`, `?`, `#`, `%`, `@`, whitespace, control chars, prototype keys, and values > 128 chars). Multi-language joins (`en+de`) are validated per-segment. The call sites now refuse to issue a request when the check fails and call back with a clear error.\n2. `omitFetchOptions` is stored per-instance on `options._omitFetchOptions`.\n3. Error-callback messages sanitise strings and redact URL credentials.\n4. `for...in` over untrusted objects replaced with `Object.keys` + prototype-key guard.\n\n### Workarounds\n\nNo workaround short of upgrading. If you cannot upgrade immediately, sanitise `lng` / `ns` yourself before they reach i18next (strip `..`, `/`, `\\`, `?`, `#`, `%`, whitespace, and control characters; cap the length).\n\n### Credits\n\nDiscovered via an internal security audit of the i18next ecosystem.","state":0,"publishedAt":"2026-04-22T17:41:24+00:00","modifiedAt":"2026-05-11T13:53:06.620917+00:00","affected":[{"ecosystem":"npm","name":"i18next-http-backend","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.0.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g","https://nvd.nist.gov/vuln/detail/CVE-2026-41691","https://github.com/i18next/i18next-http-backend/commit/4cee84f229c637b9c182366d3156f726d407a621","https://github.com/i18next/i18next-http-backend"],"sourceUrl":"https://github.com/advisories/GHSA-q89c-q3h5-w34g","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-q89c-q3h5-w34g","identifiers":["GHSA-q89c-q3h5-w34g","CVE-2026-41691"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-02T14:59:27.3742556+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-11-02T14:59:27.3742556+00:00","lastSuccessAt":"2026-11-02T14:59:27.5398045+00:00","error":null,"lastVerifiedAt":"2026-11-02T14:59:27.5398049+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-37087f5ac35d6d996bd0480d4228062695465d95096b336bdfd509d8efa3a1e5-e9090eff5bc590c67f3f1419d8577c44ef22f348a02ffe003f67c52a46acd979","complete":true,"records":417855,"lastAttemptAt":"2026-11-02T14:57:29.5569228+00:00","lastSuccessAt":"2026-11-02T14:57:29.5030542+00:00","error":null,"lastVerifiedAt":"2026-11-02T14:57:29.5569228+00:00","snapshotPublishedAt":"2026-11-02T14:22:52+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-3afbfcfae1fe455bbc5a5006f95b2df4","complete":true,"records":13568,"lastAttemptAt":"2026-11-02T14:59:29.4659591+00:00","lastSuccessAt":"2026-11-02T11:59:30.621+00:00","error":null,"lastVerifiedAt":"2026-11-02T11:59:30.621+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-02T14:59:27.3742556+00:00","complete":true,"records":1095,"lastAttemptAt":"2026-11-02T14:59:27.3742556+00:00","lastSuccessAt":"2026-11-02T14:59:27.5408035+00:00","error":null,"lastVerifiedAt":"2026-11-02T14:59:27.5408036+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-622e6c116ade494aa7fc9e124415c9ab","complete":true,"records":13580,"lastAttemptAt":"2026-11-02T14:59:28.840649+00:00","lastSuccessAt":"2026-11-02T14:59:28.837+00:00","error":null,"lastVerifiedAt":"2026-11-02T14:59:28.837+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-11-02T14:59:27.220262+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-11-02T14:59:27.220262+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-11-02T14:57:29.6157326+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-11-02T14:57:29.6157326+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-5eac0f41c5234939771ec81ee6dcecba911c3ba21e363f4cecd95fcede18b96b","complete":true,"records":3035,"lastAttemptAt":"2026-11-02T14:59:27.328544+00:00","lastSuccessAt":"2026-11-02T13:57:36.6498985+00:00","error":null,"lastVerifiedAt":"2026-11-02T14:59:27.328544+00:00","snapshotPublishedAt":"2026-11-02T12:18:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f6b161b825bd02c4d85a20025f15e385f08d9727774eb866871eb8f3ef9e379f","complete":true,"records":231021,"lastAttemptAt":"2026-11-02T14:59:27.0921031+00:00","lastSuccessAt":"2026-11-02T14:59:25.6503802+00:00","error":null,"lastVerifiedAt":"2026-11-02T14:59:27.0921031+00:00","snapshotPublishedAt":"2026-11-02T14:33:25+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}