npm: i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

npm: i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts lng in the query string vulnerability discovered by ? in WordPress npm i18next-http-backend versions 4.0.4...