locize
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| gettext-converter | 1 | – | Sep 14, 2026 |
| i18next-locize-backend | 1 | – | May 8, 2026 |
| locize | 1 | – | May 8, 2026 |
Exploited and recent CVEs
- CVE-2026-55451 gettext-converter: Prototype pollution in js2i18next() via crafted translation keys 0.6%
- CVE-2026-41886 locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor 0.1%
- CVE-2026-41885 Path traversal / URL injection via unsanitised lng/ns/projectId/version in i18next-locize-backend 0.2%