CVE-2026-115730 — i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl
i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. …
Published: 2026-10-23 · CVSS: 2.3 · CVSS 4.0
i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7