Live › vulnerability › CVE-2026-115730
Go to dashboardi18next-http-backend 4.0.2 has an incomplete fix in interpolateUrl(): a namespace value starting with a slash turns the translation URL into a protocol-relative URL. An attacker who controls the namespace can load translations from an attacker-hosted server, which can inject UI content and cross-site scripting.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use i18next-http-backend 4.0.2 and build translation URLs from a namespace value that a user can influence. Apps with fixed namespace names or no user input in the translation path are unlikely to be exposed.
No product ranges from the sources yet.
npm ls i18next-http-backendloadPath or addPath templates that interpolate a user-controlled namespace valueUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.
This page as .md · .json · in your agent: get_signal("CVE-2026-115730")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.