Source: node-i18next-http-backend Version: 2.4.1+ds-2 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for node-i18next-http-backend. CVE-2026-41691[0]: | Copilot said: i18nextify is a JavaScript library that adds | i18nextify is a JavaScript library that adds website | internationalization via a script tag, without source code changes. | Versions prior to 3.0.5 interpolate the lng and ns values directly | into the configured loadPath / addPath URL template without any | encoding, validation, or path sanitisation. When an application | exposes the language-code selection to user-controlled input (the | default — i18next-browser-languagedetector reads ?lng= query params, | cookies, localStorage, and request headers), an attacker can inject | characters that change the structure of the outgoing request URL. | This is a single URL-injection vulnerability. The attacker- | controlled value is neutralised before it is used as part of an | output URL string; the attack shape covers both path traversal and | broader URL-structure injection — both are closed by the one | interpolateUrl sanitisation fix. This issue has been fixed in | version 3.0.5. If users cannot upgrade immediately, they can work | around the issue by sanitising lng / ns before they reach i18next | (strip .., /, \, ?, #, %, whitespace, and control characters; cap | the length). Note, the fix needs to be made complete to not open CVE-2026-105800, which exists due to an incomplete fix for CVE-2026-41691. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-41691 https://www.cve.org/CVERecord?id=CVE-2026-41691 [1] https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g [2] https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf Please adjust the affected versions in the BTS as needed. Regards, Salvatore
