{"id":"EUVD-2026-108941","enisaUuid":"3e6f6d06-a1a4-3078-ab21-afcb3c6bc092","description":"i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.","datePublished":"Oct 23, 2026, 12:55:09 PM","dateUpdated":"Oct 29, 2026, 1:19:15 PM","baseScore":2.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5\nhttps://github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7\nhttps://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf\nhttps://www.vulncheck.com/advisories/i18next-http-backend-4.0.2-protocol-relative-url-injection-via-namespace-in-interpolateurl\n","aliases":"CVE-2026-115730\nGHSA-w47m-j727-m843\nGHSA-9jhj-wvmw-cfx5\n","assigner":"VulnCheck","epss":0.32,"enisaIdProduct":[{"id":"6aa18427-6fc7-3bde-899d-0e7566ccbfc3","product":{"name":"i18next-http-backend","vendor":{"name":"i18next"}},"product_version":"4.0.2 \u003c4.0.3"}],"enisaIdVendor":[{"id":"cbc83623-eed9-3b8f-aa32-5b2d406e9f3f","vendor":{"name":"i18next"}}],"enisaIdVulnerability":[{"id":"dc6491c1-a9b8-36a4-b646-4d22c92a6075","vulnerability":{"id":"GHSA-9jhj-wvmw-cfx5","description":"i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)","datePublished":"Oct 28, 2026, 9:07:57 PM","dateUpdated":"Oct 28, 2026, 9:07:57 PM","baseScore":0.0,"references":"https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115730\nhttps://github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7\nhttps://github.com/i18next/i18next-http-backend\nhttps://www.vulncheck.com/advisories/i18next-http-backend-4.0.2-protocol-relative-url-injection-via-namespace-in-interpolateurl\n","enisa_id":"EUVD-2026-108941\n","aliases":"GHSA-9jhj-wvmw-cfx5\nCVE-2026-115730\n","epss":0.0,"dataProcessed":"Nov 3, 2026, 7:03:11 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e2912159-0df0-3116-9544-5451af782019","vulnerability":{"id":"CVE-2026-115730","description":"i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.","datePublished":"Oct 23, 2026, 12:55:09 PM","dateUpdated":"Oct 29, 2026, 1:19:15 PM","status":"PUBLISHED","baseScore":2.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5\nhttps://github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7\nhttps://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf\nhttps://www.vulncheck.com/advisories/i18next-http-backend-4.0.2-protocol-relative-url-injection-via-namespace-in-interpolateurl\n","enisa_id":"EUVD-2026-108941\n","assigner":"VulnCheck","epss":0.32,"dataProcessed":"Nov 3, 2026, 7:14:44 AM","vulnerabilityProduct":[{"id":"8a048d5b-e6dd-33c4-a4d3-002de1f0eed4","product":{"name":"i18next-http-backend","vendor":{"name":"i18next"}},"product_version":"4.0.2 \u003c4.0.3"}],"vulnerabilityVendor":[{"id":"8f64ae1f-5235-33ff-ab99-e9527b4d57e9","vendor":{"name":"i18next"}}]}},{"id":"e9d5cfc7-2b8f-381a-a05f-5a73041a9221","vulnerability":{"id":"GHSA-w47m-j727-m843","description":"Duplicate Advisory: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)","datePublished":"Oct 23, 2026, 3:31:30 PM","dateUpdated":"Oct 28, 2026, 9:07:51 PM","baseScore":0.0,"references":"https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5\nhttps://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115730\nhttps://github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7\nhttps://www.vulncheck.com/advisories/i18next-http-backend-4.0.2-protocol-relative-url-injection-via-namespace-in-interpolateurl\n","enisa_id":"EUVD-2026-108941\n","aliases":"GHSA-w47m-j727-m843\n","epss":0.0,"dataProcessed":"Nov 3, 2026, 7:03:11 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}