6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41691

CVE-2026-41691: i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns

Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 3.0.5 interpolate the lng and ns values directly into the configured loadPath / addPath URL template without any encoding, validation, or path sanitisation. When an application exposes the language-code selection to user-controlled input (the default — i18next-browser-languagedetector reads ?lng= query params, cookies, localStorage, and request headers), an attacker can inject characters that change the structure of the outgoing request URL. This is a single URL-injection vulnerability. The attacker-controlled value is neutralised before it is used as part of an output URL string; the attack shape covers both path traversal and broader URL-structure injection — both are closed by the one interpolateUrl sanitisation fix. This issue has been fixed in version 3.0.5. If users cannot upgrade immediately, they can work around the issue by sanitising lng / ns before they reach i18next (strip .., /, , ?, #, %, whitespace, and control characters; cap the length).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41691

CVE-2026-41691:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
i18next-http-backend	npm	< 3.0.5	3.0.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The primary vulnerability in i18next-http-backend prior to version 3.0.5 is a path traversal and URL injection issue (CWE-22, CWE-74). The root cause lies in the interpolate function in lib/utils.js, which was used to construct resource URLs. This function did not sanitize the lng (language) and ns (namespace) parameters before inserting them into the URL path template. Since these parameters can be controlled by a user (e.g., via query parameters like ?lng=...), an attacker could provide crafted values containing characters like ../ to traverse the file system and access unintended files, especially in server-side rendering (SSR) environments using file:// schemes. This could lead to sensitive information disclosure or SSRF.

The patch addresses this by introducing a new function, interpolateUrl, which validates the lng and ns values against a denylist of unsafe characters and patterns using the isSafeUrlSegment helper. The vulnerable call sites in _readAny and create within lib/index.js were updated to use this new secure function.

Additionally, the security patch hardens the library against prototype pollution vulnerabilities in addQueryString and requestWithXmlHttpRequest by replacing for...in loops with Object.keys(), preventing the injection of unintended query parameters or HTTP headers from a polluted Object.prototype.

Vulnerable functions

Backend._readAny

lib/index.js

This function constructs a request URL by calling the `interpolate` function with user-controlled `languages` and `namespaces` parameters. The lack of input sanitization in `interpolate` allows for path traversal and URL injection.

Backend.create

lib/index.js

Similar to `_readAny`, this function uses the vulnerable `interpolate` function to build a URL for adding new resources, passing unsanitized `lng` and `namespace` parameters, which can be exploited for path traversal.

interpolate

lib/utils.js

This is the core vulnerable function. It performs template string interpolation without sanitizing the input values. When user-controlled data (like `lng` or `ns`) is passed, it can lead to path traversal, URL injection, and other attacks because special characters like `.` , `/`, `?`, and `#` are not handled.

addQueryString

lib/request.js

This function was vulnerable to prototype pollution. It used a `for...in` loop to iterate over request parameters, which could include properties from a polluted `Object.prototype`. An attacker could potentially inject unwanted query parameters into outgoing requests.

requestWithXmlHttpRequest

lib/request.js

This function was vulnerable to prototype pollution when setting custom headers for an XMLHttpRequest. It used a `for...in` loop, which could allow an attacker to inject malicious headers if the `Object.prototype` was polluted.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.