Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118258— i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

Quick assessment

Affected
i18next i18next-http-backend
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

是 的一个后端层，用于在 Node.js、浏览器和 Deno 环境中加载翻译资源。在 4.0.4 版本之前， 函数会将未编码的语言（lng）和命名空间（ns）值直接插入到 或 模板中，且未拒绝使用 ampersand（&）、equals（=）或 semicolon（;）作为查询字符串分隔符。当模板将 或 置于查询字符串中，且攻击者能够控制这些值时，攻击者便可以在浏览器端或服务器端的翻译请求中添加或覆盖参数。这可能导致其他命名空间或租户的信息被泄露，或通过利用应用程序在网络中的位置及其凭证，改变后端行为。该漏洞是 C

CVSS 3.7 · Low

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
i18next i18next-http-backend < 4.0.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118258

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string
Source: CVE Program / CVE List V5
Vulnerability Description
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand (&), equals (=), or semicolon (;) query separators. When a template places lng or ns in the query string and an attacker controls that value, the attacker can add or override parameters on browser or server-side translation requests, potentially exposing other namespaces or tenants or changing backend behavior through the application's network position and credentials. This vulnerability is the result of an incomplete fix for CVE-2026-41691. This issue is fixed in version 4.0.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
i18next i18next-http-backend < 4.0.4 -

II. Public POCs for CVE-2026-118258

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118258

请登录查看更多情报信息。

Other References for CVE-2026-118258 (3)

IV. Related Vulnerabilities

Same product: i18next-http-backend
Same vendor: i18next
Same weakness: CWE-74