CVE-2026-115730
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.
Risk Assessment
An attacker can inject malicious content into the user interface and conduct XSS, potentially leading to user session takeover.
Recommendation
Upgrade i18next-http-backend to a version with the complete fix or add validation of ns values blocking those starting with a slash. Consider limiting trust in external translation sources.
Other vulnerabilities in i18next-http-backend
See all- CVE-2026-118258Low
i18next-http-backend prior to 4.0.4 has interpolateUrl inserting unencoded language and namespace values into loadPath or addPath templates without rejecting &, =, or ; query separators. When a template places lng or ns in the query string and an attacker controls that value, the attacker can add or override parameters on translation requests, potentially exposing other namespaces or tenants. This is an incomplete fix for CVE-2026-41691, fixed in 4.0.4.
- CVE-2026-105800Low
i18next-http-backend prior to 4.0.2 allows attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} to make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery.
Original NVD description (English source)
i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS