I18Next
Monthly
Remote prototype pollution in i18next-http-middleware before 3.9.7 allows unauthenticated attackers to write to Object.prototype by submitting dotted request-body keys such as '__proto__.polluted' to the missingKeyHandler. The 3.9.3 denylist blocked only literal unsafe keys; downstream backends (notably i18next-fs-backend ≤ 2.6.5) that split missing-key strings on the configured keySeparator then walked these segments into an unguarded setPath(). No public exploit identified at time of analysis, but PoC payloads are embedded in the upstream security test suite.
Prototype pollution in i18next-fs-backend versions prior to 2.6.6 allows remote attackers to write arbitrary properties onto Object.prototype by submitting crafted missing-translation keys such as '__proto__.polluted' to applications that expose i18next-http-middleware's missingKeyHandler to untrusted input. Backend.writeFile() split keys on the configured keySeparator (default '.') and the getLastOfPath walker in lib/utils.js did not filter unsafe segments before traversing the target object. No public exploit identified at time of analysis, but a coordinated-disclosure advisory (GHSA-2933-q333-qg83) and a fixing commit are public, and downstream impact can include denial of service, configuration poisoning, and bypass of property-based security checks.
Path traversal in i18next-fs-backend allows remote unauthenticated attackers to read arbitrary files (including /etc/passwd) or overwrite application files when language/namespace parameters derive from user input. Applications exposing i18next language detection via query strings, cookies, or headers (common with i18next-http-middleware or i18next-browser-languagedetector) are vulnerable to immediate exploitation with zero authentication (CVSS AV:N/AC:L/PR:N/UI:N). GitHub security advisory confirms the vulnerability with proof-of-concept parameter `?lng=../../../../etc/passwd`. Fixed in version 2.6.4; vulnerable versions also support eval-based .js/.ts locale loading, creating a code execution chain when traversal targets executable files.
Object.prototype pollution in i18next-http-middleware prior to 3.9.3 allows remote unauthenticated attackers to inject arbitrary properties into all JavaScript objects via crafted HTTP requests, bypassing authorization checks, causing type-confusion denial of service, or enabling remote code execution when chained with vulnerable downstream code. The vulnerability is actively exploitable through two unprotected API endpoints (getResourcesHandler and missingKeyHandler) that accept user-controlled language and namespace parameters without validation. EPSS data not provided, not listed in CISA KEV, but publicly disclosed with detailed GitHub security advisory including technical exploitation details.
Path traversal and URL-structure injection in i18next-http-backend before 3.0.5 let remote unauthenticated attackers who control the lng or ns value reshape the translation-request URL; this is the default exposure when i18next-browser-languagedetector reads ?lng=, cookies, localStorage or request headers. Real impact depends on deployment: file:// or internal loadPath values in server-side rendering can yield arbitrary host file read or SSRF, and prefix-based authorization can be bypassed, while static client-side locale fetching over HTTP usually sees only benign path changes or fragment truncation. No public exploit has been identified at time of analysis; EPSS is 0.05% (15th percentile), it is not in CISA KEV, and the vendor fix is 3.0.5, with a vuln.today priority label of act_now.
i18next core versions up to and including 26.3.3 allow process-wide corruption of shared built-in objects such as Object.prototype.hasOwnProperty when an application deep-merges untrusted resource data via addResourceBundle(lng, ns, data, deep, overwrite) with both deep:true and overwrite:true. Supplying a source key that matches an inherited built-in (hasOwnProperty, toString, valueOf) makes deepExtend recurse into that shared function and, with overwrite enabled, set one of its properties to attacker-controlled data - for example making Object.prototype.hasOwnProperty.call non-callable - after which subsequent calls, including i18next's own internals, throw TypeError and the process cannot recover, yielding denial of service with limited integrity impact. The configuration is non-default and no standard i18next backend or integration uses it, so exposure is confined to custom application code that merges attacker-controlled translation content; the CVSS vector scores PR:L with AC:H, and no public exploit identified at time of analysis beyond the proof-of-concept snippet published in the vendor advisory (a public PoC reference exists; it is not verified as working exploit code).
Query-parameter injection in i18next-http-backend before 4.0.4 lets attacker-controlled language or namespace values add or override parameters on outgoing translation requests whenever a loadPath or addPath template places {{lng}} or {{ns}} in the query string, such as the multiload shape /locales/resources.json?lng={{lng}}&ns={{ns}}. Server-side deployments using i18next-http-middleware's LanguageDetector are the most exposed case: an unauthenticated visitor supplying ?lng=de%26ns%3Dprivate%26admin%3Dtrue can make the application issue a request to its own translations API as ...?lng=de&ns=private&admin=true&ns=common, leveraging the server's network position and credentials; on the browser side the same crafted link affects the victim's same-origin request. Severity is bounded (CVSS 3.1 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) because exploitation requires both a query-shaped template and attacker control of the language or namespace value, and real impact depends on how the translations API branches on the injected parameters; the default /locales/{{lng}}/{{ns}}.json template and supportedLngs-restricted applications are unaffected, the advisory publishes a proof-of-concept script, and no confirmed active exploitation is reported in the available sources (priority label: monitor).
Protocol-relative URL injection in i18next-http-backend before 4.0.3 lets an attacker who controls an i18next namespace value redirect translation fetches to an attacker-chosen origin when the loadPath/addPath template places {{ns}} directly after a leading slash. The per-value validation added for the earlier GHSA-xvq9-wjp8-hwqf fix rejects '//evil.example' but still permits a single leading '/', which the template's own '/' turns into '//evil.example/en.json' - a URL browsers resolve off-origin, yielding translation content injection and, where translations are rendered as HTML, cross-site scripting. Exploitation requires the non-default template, attacker-controlled namespace input (applications usually set namespaces in code), and a browser context; Node is not affected, the default '/locales/{{lng}}/{{ns}}.json' template is not affected, and the issue is not known to be exploited in the wild. A minimal proof-of-concept is published in the advisory and was re-verified against 4.0.2, and the release 4.0.3 contains the fix.
URL injection and server-side request forgery (SSRF) in i18next-http-backend prior to 4.0.2 allows attacker-controlled language or namespace values to redirect translation resource requests away from the intended origin, but only when the application configures a custom loadPath or addPath template that begins directly with the {{lng}} or {{ns}} placeholder. Because the placeholder must occupy the URL's structural beginning for a colon to form an absolute URL (or, in browsers, a double-slash namespace to form a protocol-relative URL), the default '/locales/{{lng}}/{{ns}}.json' template and any template with a leading path or origin prefix are unaffected; this uncommon configuration and the need to control the language/namespace input drive the High attack complexity rating. Impact is limited to low confidentiality loss (blind SSRF/URL injection with no integrity or availability effect), and all signals indicate a low-priority issue - no public exploit code and no confirmed active exploitation were identified at time of analysis. The issue is fixed in version 4.0.2.
DOM-based cross-site scripting (XSS) in i18nextify versions prior to 4.0.8 allows remote attackers to execute arbitrary JavaScript by injecting malicious URL schemes (javascript:, data:, vbscript:, file:) into translated href and src attribute values. An attacker who can compromise the translation backend, CDN, or intercept unencrypted traffic can inject payloads that execute with the origin's privileges when users interact with the affected links or embedded content. The vulnerability requires user interaction (clicking a link or loading a page with a malicious src) but affects any website using i18nextify with untrusted translation sources.
Remote prototype pollution in i18next-http-middleware before 3.9.7 allows unauthenticated attackers to write to Object.prototype by submitting dotted request-body keys such as '__proto__.polluted' to the missingKeyHandler. The 3.9.3 denylist blocked only literal unsafe keys; downstream backends (notably i18next-fs-backend ≤ 2.6.5) that split missing-key strings on the configured keySeparator then walked these segments into an unguarded setPath(). No public exploit identified at time of analysis, but PoC payloads are embedded in the upstream security test suite.
Prototype pollution in i18next-fs-backend versions prior to 2.6.6 allows remote attackers to write arbitrary properties onto Object.prototype by submitting crafted missing-translation keys such as '__proto__.polluted' to applications that expose i18next-http-middleware's missingKeyHandler to untrusted input. Backend.writeFile() split keys on the configured keySeparator (default '.') and the getLastOfPath walker in lib/utils.js did not filter unsafe segments before traversing the target object. No public exploit identified at time of analysis, but a coordinated-disclosure advisory (GHSA-2933-q333-qg83) and a fixing commit are public, and downstream impact can include denial of service, configuration poisoning, and bypass of property-based security checks.
Path traversal in i18next-fs-backend allows remote unauthenticated attackers to read arbitrary files (including /etc/passwd) or overwrite application files when language/namespace parameters derive from user input. Applications exposing i18next language detection via query strings, cookies, or headers (common with i18next-http-middleware or i18next-browser-languagedetector) are vulnerable to immediate exploitation with zero authentication (CVSS AV:N/AC:L/PR:N/UI:N). GitHub security advisory confirms the vulnerability with proof-of-concept parameter `?lng=../../../../etc/passwd`. Fixed in version 2.6.4; vulnerable versions also support eval-based .js/.ts locale loading, creating a code execution chain when traversal targets executable files.
Object.prototype pollution in i18next-http-middleware prior to 3.9.3 allows remote unauthenticated attackers to inject arbitrary properties into all JavaScript objects via crafted HTTP requests, bypassing authorization checks, causing type-confusion denial of service, or enabling remote code execution when chained with vulnerable downstream code. The vulnerability is actively exploitable through two unprotected API endpoints (getResourcesHandler and missingKeyHandler) that accept user-controlled language and namespace parameters without validation. EPSS data not provided, not listed in CISA KEV, but publicly disclosed with detailed GitHub security advisory including technical exploitation details.
Path traversal and URL-structure injection in i18next-http-backend before 3.0.5 let remote unauthenticated attackers who control the lng or ns value reshape the translation-request URL; this is the default exposure when i18next-browser-languagedetector reads ?lng=, cookies, localStorage or request headers. Real impact depends on deployment: file:// or internal loadPath values in server-side rendering can yield arbitrary host file read or SSRF, and prefix-based authorization can be bypassed, while static client-side locale fetching over HTTP usually sees only benign path changes or fragment truncation. No public exploit has been identified at time of analysis; EPSS is 0.05% (15th percentile), it is not in CISA KEV, and the vendor fix is 3.0.5, with a vuln.today priority label of act_now.
i18next core versions up to and including 26.3.3 allow process-wide corruption of shared built-in objects such as Object.prototype.hasOwnProperty when an application deep-merges untrusted resource data via addResourceBundle(lng, ns, data, deep, overwrite) with both deep:true and overwrite:true. Supplying a source key that matches an inherited built-in (hasOwnProperty, toString, valueOf) makes deepExtend recurse into that shared function and, with overwrite enabled, set one of its properties to attacker-controlled data - for example making Object.prototype.hasOwnProperty.call non-callable - after which subsequent calls, including i18next's own internals, throw TypeError and the process cannot recover, yielding denial of service with limited integrity impact. The configuration is non-default and no standard i18next backend or integration uses it, so exposure is confined to custom application code that merges attacker-controlled translation content; the CVSS vector scores PR:L with AC:H, and no public exploit identified at time of analysis beyond the proof-of-concept snippet published in the vendor advisory (a public PoC reference exists; it is not verified as working exploit code).
Query-parameter injection in i18next-http-backend before 4.0.4 lets attacker-controlled language or namespace values add or override parameters on outgoing translation requests whenever a loadPath or addPath template places {{lng}} or {{ns}} in the query string, such as the multiload shape /locales/resources.json?lng={{lng}}&ns={{ns}}. Server-side deployments using i18next-http-middleware's LanguageDetector are the most exposed case: an unauthenticated visitor supplying ?lng=de%26ns%3Dprivate%26admin%3Dtrue can make the application issue a request to its own translations API as ...?lng=de&ns=private&admin=true&ns=common, leveraging the server's network position and credentials; on the browser side the same crafted link affects the victim's same-origin request. Severity is bounded (CVSS 3.1 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) because exploitation requires both a query-shaped template and attacker control of the language or namespace value, and real impact depends on how the translations API branches on the injected parameters; the default /locales/{{lng}}/{{ns}}.json template and supportedLngs-restricted applications are unaffected, the advisory publishes a proof-of-concept script, and no confirmed active exploitation is reported in the available sources (priority label: monitor).
Protocol-relative URL injection in i18next-http-backend before 4.0.3 lets an attacker who controls an i18next namespace value redirect translation fetches to an attacker-chosen origin when the loadPath/addPath template places {{ns}} directly after a leading slash. The per-value validation added for the earlier GHSA-xvq9-wjp8-hwqf fix rejects '//evil.example' but still permits a single leading '/', which the template's own '/' turns into '//evil.example/en.json' - a URL browsers resolve off-origin, yielding translation content injection and, where translations are rendered as HTML, cross-site scripting. Exploitation requires the non-default template, attacker-controlled namespace input (applications usually set namespaces in code), and a browser context; Node is not affected, the default '/locales/{{lng}}/{{ns}}.json' template is not affected, and the issue is not known to be exploited in the wild. A minimal proof-of-concept is published in the advisory and was re-verified against 4.0.2, and the release 4.0.3 contains the fix.
URL injection and server-side request forgery (SSRF) in i18next-http-backend prior to 4.0.2 allows attacker-controlled language or namespace values to redirect translation resource requests away from the intended origin, but only when the application configures a custom loadPath or addPath template that begins directly with the {{lng}} or {{ns}} placeholder. Because the placeholder must occupy the URL's structural beginning for a colon to form an absolute URL (or, in browsers, a double-slash namespace to form a protocol-relative URL), the default '/locales/{{lng}}/{{ns}}.json' template and any template with a leading path or origin prefix are unaffected; this uncommon configuration and the need to control the language/namespace input drive the High attack complexity rating. Impact is limited to low confidentiality loss (blind SSRF/URL injection with no integrity or availability effect), and all signals indicate a low-priority issue - no public exploit code and no confirmed active exploitation were identified at time of analysis. The issue is fixed in version 4.0.2.
DOM-based cross-site scripting (XSS) in i18nextify versions prior to 4.0.8 allows remote attackers to execute arbitrary JavaScript by injecting malicious URL schemes (javascript:, data:, vbscript:, file:) into translated href and src attribute values. An attacker who can compromise the translation backend, CDN, or intercept unencrypted traffic can inject payloads that execute with the origin's privileges when users interact with the affected links or embedded content. The vulnerability requires user interaction (clicking a link or loading a page with a malicious src) but affects any website using i18nextify with untrusted translation sources.