{"id":"ghsa-ghsa-3cmx-xjww-583x","seq":2056940,"kind":"advisory","title":"i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string","url":"https://github.com/advisories/GHSA-3cmx-xjww-583x","permalink":"https://vulnpulse.app/items/ghsa-ghsa-3cmx-xjww-583x","summary":"影響: npm:i18next-http-backend < 4.0.4 → 4.0.4\nThe URL-segment check added for GHSA-q89c-q3h5-w34g blocks ?, #, %, :, / and @ in lng, but not & or =, and the checked value is inserted into the URL without encoding. The README documents a multiload loadPath of the form /locales/resources.json?lng=de+en&ns=ns1+ns2. With a template like that, an attacker who controls the language value can add or override query parameters on the request the backend sends. By default the language comes from ?lng=, a cookie or Accept-Language. This is the \"query…","severity":"low","techs":["nodejs"],"cves":["CVE-2026-118258"],"tags":["GHSA-3cmx-xjww-583x","i18next-http-backend"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:10:08.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}