Directory Traversal

Overview i18next-http-backend is an i18next-http-backend is a backend layer for i18next using in Node.js, in the browser and for Deno. Affected versions of this package are vulnerable to Directory Traversal or other URL manipulation, via unsanitized interpolation of lng and ns values in the...

GHSA-Q89C-Q3H5-W34G i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns

Summary Versions of i18next-http-backend prior to 3.0.5 interpolate the lng and ns values directly into the configured loadPath / addPath URL template without any encoding, validation, or path sanitisation. When an application exposes the language-code selection to user-controlled input the defau...

i18next-http-middleware: Prototype pollution and path traversal via user-controlled language and namespace parameters

Summary Versions of i18next-http-middleware prior to 3.9.3 pass user-controlled lng and ns parameters to two internal paths that use them in ways that enable prototype pollution and, depending on the configured backend, path traversal or SSRF. The vulnerable entry points are unauthenticated HTTP...

Prototype Pollution

Overview i18next-http-middleware is an i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Affected versions of this package are vulnerable to Prototype Pollution via the lng or ns parameters handled by the getResourcesHandler...

PT-2026-37150

Name of the Vulnerable Software and Affected Versions i18next-http-middleware versions prior to 3.9.3 Description An unauthenticated HTTP client can pollute Object.prototype in the Node.js process hosting the middleware. This occurs via two unvalidated entry points: getResourcesHandler and...

PT-2026-34624

Name of the Vulnerable Software and Affected Versions i18next-http-middleware versions prior to 3.9.3 Description The software writes user-controlled language values into the 'Content-Language' response header using an HTML-entity encoder that fails to strip carriage return, line feed, or other...

PT-2026-37155

Name of the Vulnerable Software and Affected Versions i18next-locize-backend versions prior to 9.0.2 Description The software interpolates lng, ns, projectId, and version directly into configured URL templates such as 'loadPath', 'privatePath', 'addPath', 'updatePath', and 'getLanguagesPath'...

PT-2026-37153

Name of the Vulnerable Software and Affected Versions i18next-fs-backend versions prior to 2.6.4 Description i18next-fs-backend substitutes the lng and ns options directly into the configured loadPath and addPath templates to read or write files from the disk. Because this interpolation is...

EUVD-2025-198722

Malicious code in @ensdomains/vite-plugin-i18next-loader npm...

Malicious code in @ensdomains/vite-plugin-i18next-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 473280de7d29dd017bfa50f0826a0aa810d204a6949fe49d6753ff28ff61d505 The package @ensdomains/vite-plugin-i18next-loader was found to contain malicious code. Source: ghsa-malware...

EUVD-2018-0260

Malware in sbrugna...

EUVD-2018-0747

Malware in sbrugna...

Malicious Package

Overview @sev-ui-verse/i18next-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @sev-ui-verse/i18next-config (npm)

The package @sev-ui-verse/i18next-config was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0a4074d88681a40324dc4f76ce6e6339cb36c218478b433434a961e47adfac2 Any computer that has this package installed or running should be considere...

MAL-2025-47539 Malicious code in @sev-ui-verse/i18next-config (npm)

The package @sev-ui-verse/i18next-config was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0a4074d88681a40324dc4f76ce6e6339cb36c218478b433434a961e47adfac2 Any computer that has this package installed or running should be considere...

Malicious code in i18next-xlsx-to-json (npm)

The package i18next-xlsx-to-json was found to contain malicious code...

MAL-2025-22869 Malicious code in i18next-xlsx-to-json (npm)

The package i18next-xlsx-to-json was found to contain malicious code...

Malicious code in prettier-plugin-kimi-i18next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af4d7ca5eeefbb8afdac5b1e3ea5b5507fa5b253420d598b4d1d0f5693c841c5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10770 Malicious code in prettier-plugin-kimi-i18next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af4d7ca5eeefbb8afdac5b1e3ea5b5507fa5b253420d598b4d1d0f5693c841c5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8398 Malicious code in @tpci/i18next-ext (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 14a4fd8041934f617af9e84fb00ca939b961316d3d7b9519c286dd93035801c8 The OpenSSF Package Analysis project identified '@tpci/i18next-ext' @ 1.6.0 npm as malicious. It is considered malicious because: - The package...