{"id":"EUVD-2026-28795","enisaUuid":"44616eb1-7e3c-30e9-bed5-542a55a68cd3","description":"i18next-locize-backend is a simple i18next backend for locize.com which can be used in Node.js, in the browser and for Deno. Prior to version 9.0.2, i18next-locize-backend interpolates lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath / getLanguagesPath URL templates with no path-component validation and no encoding. When an application exposes any of these values to user-controlled input (?lng\u003d / ?ns\u003d query parameters via i18next-browser-languagedetector, cookies, request headers, or a URL-derived projectId), a crafted value can change the structure of the outgoing request URL. Affected call sites in lib/index.js (pre-patch): the interpolate() helper is used at the five URL-build sites — _readAny/read (line 415 for private, 426 for public), getLanguages (lines 271 and 296), and writePage (lines 616 and 622) for the missing-key and update POST paths. The helper interpolate in lib/utils.js substitutes raw values with no encoding. This issue has been patched in version 9.0.2.","datePublished":"May 8, 2026, 3:41:14 PM","dateUpdated":"May 8, 2026, 4:06:11 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/locize/i18next-locize-backend/security/advisories/GHSA-mgcp-mfp8-3q45\n","aliases":"CVE-2026-41885\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"c253a363-8702-394e-9994-4c549cbc84d9","product":{"name":"i18next-locize-backend","vendor":{"name":"locize"}},"product_version":"\u003c 9.0.2"}],"enisaIdVendor":[{"id":"0b0dad22-ee53-3b1d-b0a3-066d43e16664","vendor":{"name":"locize"}}],"enisaIdVulnerability":[{"id":"9cacb390-bf0c-3af4-aa12-c1bcf914d091","vulnerability":{"id":"CVE-2026-41885","description":"i18next-locize-backend is a simple i18next backend for locize.com which can be used in Node.js, in the browser and for Deno. Prior to version 9.0.2, i18next-locize-backend interpolates lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath / getLanguagesPath URL templates with no path-component validation and no encoding. When an application exposes any of these values to user-controlled input (?lng\u003d / ?ns\u003d query parameters via i18next-browser-languagedetector, cookies, request headers, or a URL-derived projectId), a crafted value can change the structure of the outgoing request URL. Affected call sites in lib/index.js (pre-patch): the interpolate() helper is used at the five URL-build sites — _readAny/read (line 415 for private, 426 for public), getLanguages (lines 271 and 296), and writePage (lines 616 and 622) for the missing-key and update POST paths. The helper interpolate in lib/utils.js substitutes raw values with no encoding. This issue has been patched in version 9.0.2.","datePublished":"May 8, 2026, 3:41:14 PM","dateUpdated":"May 8, 2026, 4:06:11 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/locize/i18next-locize-backend/security/advisories/GHSA-mgcp-mfp8-3q45\n","enisa_id":"EUVD-2026-28795\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Nov 3, 2026, 7:17:26 AM","vulnerabilityProduct":[{"id":"781b0d48-9e55-3656-96d4-1a22c59ca2c4","product":{"name":"i18next-locize-backend","vendor":{"name":"locize"}},"product_version":"\u003c 9.0.2"}],"vulnerabilityVendor":[{"id":"bdc150f8-f47e-354d-b1fe-c7626d184561","vendor":{"name":"locize"}}]}}],"enisaIdAdvisory":[]}