File Manipulation Vulnerability in i18next-fs-backend for Node.js and Deno

CVE-2026-41693

What is CVE-2026-41693?

The i18next-fs-backend, utilized in Node.js and Deno applications for loading translations from the filesystem, is susceptible to a file manipulation vulnerability. Prior to version 2.6.4, the backend fails to properly validate and encode the lng and ns options when substituting them into the configured loadPath/addPath templates. This oversight allows an attacker to exploit crafted arguments, such as path traversal sequences, enabling them to read or overwrite files outside of the intended locale directory. For instance, when the lng or ns values are influenced by untrusted input, an attacker might send a request like ?lng=../../../../etc/passwd, prompting the backend to attempt reading sensitive files. This vulnerability underscores the importance of input validation and encoding in safeguarding file system operations.

References