CVE-2026-41693

i18next-fs-backend is a backend layer for i18next using in Node.js and for Deno to load translations from the filesystem. Prior to version 2.6.4, i18next-fs-backend substitutes the lng and ns options directly into the configured loadPath / addPath templates and then read / write the resulting file from disk. The interpolation is unencoded and unvalidated, so a crafted lng or ns value — containing .., a path separator, a control character, a prototype key, or simply an unexpectedly long string — allows an attacker who can influence either value to read or overwrite files outside the intended locale directory. When lng / ns are derived from untrusted input (request-scoped i18next instances behind an HTTP layer such as i18next-http-middleware, or any framework that lets the end user pick the language via query string, cookie, or header), a single request such as ?lng=../../../../etc/passwd causes the backend to attempt to read that path. This issue has been patched in version 2.6.4.

• CWE-22
• CWE-73

• https://github.com/i18next/i18next-fs-backend/security/advisories/GHSA-8847-338w-5hcj

Published

May 8, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41688Wallos is an open-source, self-hostable personal subscriptio…7.7
• CVE-2026-41689Wallos is an open-source, self-hostable personal subscriptio…6
• CVE-2026-4169A security flaw has been discovered in Tecnick TCExam up to …4.8
• CVE-2026-4169018next-http-middleware is a middleware to be used with Node.…8.6
• CVE-2026-41691Copilot said: i18nextify is a JavaScript library that adds i…9.1
• CVE-2026-41692i18nextify is a JavaScript library that adds website interna…4.7
• CVE-2026-41694Since Spring Security SAML decrypts SAML Responses as well a…5.3
• CVE-2026-41695Spring Data Commons applications may be vulnerable to denial…7.5
• CVE-2026-41696Spring Data MongoDB repository query methods annotated with …5.9
• CVE-2026-41697Spring Data Relational does not properly escape binding valu…4.8
• CVE-2026-41699Spring for GraphQL applications are vulnerable to Unsafe Des…9.8
• CVE-2026-4170A weakness has been identified in Topsec TopACM 3.0. Affecte…9.8