Protocol-Relative URL Injection Vulnerability in i18next-http-backend by i18next
CVE-2026-115730

2.3LOW

Key Information:

Vendor

I18next

Status
I18next-http-backend
Vendor
CVE Published:
23 October 2026

What is CVE-2026-115730?

The version 4.0.2 of i18next-http-backend has an incomplete fix in the interpolateUrl() function, which can potentially allow attackers to manipulate namespace values. By supplying a namespace value that starts with a slash, attackers can craft a protocol-relative URL in loadPath or addPath templates. This manipulation can lead to loading translations from unauthorized sources, facilitating UI content injection and creating a risk of cross-site scripting (XSS) attacks.

Affected Version(s)

i18next-http-backend 4.0.2 < 4.0.3

References

https://github.com/i18next/i18next-http-backend/security/...
vendor-advisory
https://github.com/i18next/i18next-http-backend/commit/04...
patch
https://github.com/i18next/i18next-http-backend/security/...
relatedvendor-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zachariah Mithani (AploSec)
.