i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

影響: npm:i18next-http-backend < 4.0.4 → 4.0.4

The URL-segment check added for GHSA-q89c-q3h5-w34g blocks ?, #, %, :, / and @ in lng, but not & or =, and the checked value is inserted into the URL without encoding. The README documents a multiload loadPath of the form /locales/resources.json?lng=de+en&ns=ns1+ns2. With a template like that, an attacker who controls the language value can add or override query parameters on the request the backend sends. By default the language comes from ?lng=, a cookie or Accept-Language. This is the "query…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 06:10, GitHub Advisory Database에서 "i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "낮음"(low)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-118258.