Live › vulnerability › GHSA-w47m-j727-m843
Go to dashboardA namespace value starting with a slash can form a protocol-relative URL in loadPath or addPath templates, so translation requests go to an attacker-chosen host. An attacker who controls the namespace can then serve translations that inject UI content and cross-site scripting.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 21:12 UTC. All times on this page are UTC.
Applications that load translations with i18next-http-backend and build loadPath or addPath with {{ns}} right after a slash, and where the namespace can come from user input. Apps with static namespace names or fixed loadPath templates are not exposed. The advisory is withdrawn as a duplicate, so the active record is GHSA-9jhj-wvmw-cfx5.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| i18next-http-backend | npm | <= 4.0.2 | – |
npm ls i18next-http-backend to find the installed version4.0.2 to the release that GHSA-9jhj-wvmw-cfx5 covers, as the advisory is a duplicate of itEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-9jhj-wvmw-cfx5. This link is maintained to preserve external references.
This page as .md · .json · in your agent: get_signal("GHSA-w47m-j727-m843")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.