TI-2026-30210 Aliases CVE-2026-41693 GHSA-8847-338w-5hcj

i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite

MEDIUM 41CWE-22Published 2026-05-08 · Updated 2026-05-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

i18next-fs-backend is a backend layer for i18next using in Node.js and for Deno to load translations from the filesystem. Prior to version 2.6.4, i18next-fs-backend substitutes the lng and ns options directly into the configured loadPath / addPath templates and then read / write the resulting file from disk. The interpolation is unencoded and unvalidated, so a crafted lng or ns value — containing .., a path separator, a control character, a prototype key, or simply an unexpectedly long string — allows an attacker who can influence either value to read or overwrite files outside the intended locale directory. When lng / ns are derived from untrusted input (request-scoped i18next instances behind an HTTP layer such as i18next-http-middleware, or any framework that lets the end user pick the language via query string, cookie, or header), a single request such as ?lng=../../../../etc/passwd causes the backend to attempt to read that path. This issue has been patched in version 2.6.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00292 21st percentileScored 2026-11-07

Fix Fixed i18next-fs-backend (i18next): 2.6.4i18next-fs-backend (npm): 2.6.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
i18next	i18next-fs-backend	before 2.6.4	2.6.4	Patch available	CNA
—	i18next-fs-backend (npm)	before 2.6.4	2.6.4	Patch available	GHSA-8847-338w-5hcj

i18next-fs-backend Vendori18next Affected before 2.6.4 Fixed in 2.6.4 Patch available CNA
i18next-fs-backend (npm) Vendor— Affected before 2.6.4 Fixed in 2.6.4 Patch available GHSA-8847-338w-5hcj

Remediation

Fix · CNA i18next-fs-backend (i18next) Fixed in 2.6.4
Fix · GHSA-8847-338w-5hcj i18next-fs-backend (npm) Fixed in 2.6.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-41693
2026-10-03 Alias added: GHSA-8847-338w-5hcj

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-41693

Other 2

TI-2026-83444 Shared built-in object corruption in i18next resource merging CVSS 3.1MEDIUM 5.9
TI-2026-82145 Query parameter injection in i18next-http-backend via lng or ns CVSS 3.1LOW 3.7
TI-2026-68453 Incomplete URL validation in i18next-http-backend permits SSRF CVSS 3.1LOW 3.7
TI-2026-35995 i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names CVSS 3.1CRITICAL 9.1
TI-2026-35994 i18next-fs-backend: Prototype pollution via crafted missing-key string CVSS 3.1CRITICAL 9.1
TI-2026-79749 Protocol-relative URL injection in i18next-http-backend CVSS 4.0LOW 2.3

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences