{"id":"GHSA-9jhj-wvmw-cfx5","revision":null,"records":[{"revision":"e87808c5cd4444c28ec4166a70b1796b","observedAt":"2026-10-29T15:12:12.364+00:00","statement":{"source":"cve-program","id":"CVE-2026-115730","aliases":[],"title":"i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl","description":"i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.","state":0,"publishedAt":"2026-10-23T12:55:09.891+00:00","modifiedAt":"2026-10-29T13:19:15.108+00:00","affected":[{"ecosystem":"Vendor product","name":"i18next-http-backend","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"i18next\",\n                    \"product\": \"i18next-http-backend\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"4.0.2\",\n                            \"lessThan\": \"4.0.3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:npm/i18next-http-backend\",\n                    \"repo\": \"https://github.com/i18next/i18next-http-backend\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":2.3,"severity":"LOW"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","score":3.1,"severity":"LOW"}],"references":["https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5","https://github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7","https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf","https://www.vulncheck.com/advisories/i18next-http-backend-4.0.2-protocol-relative-url-injection-via-namespace-in-interpolateurl"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115730","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-115730","identifiers":["CVE-2026-115730"]},"retained":false,"historicalAffected":[]},{"revision":"6c9c91eec5c64d0e884dc33edbb5a86d","observedAt":"2026-11-06T00:44:16.68+00:00","statement":{"source":"euvd","id":"EUVD-2026-108941","aliases":["CVE-2026-115730","GHSA-w47m-j727-m843","GHSA-9jhj-wvmw-cfx5"],"title":"i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-r…","description":"i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":2.3,"severity":null}],"references":["https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5","https://github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7","https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf","https://www.vulncheck.com/advisories/i18next-http-backend-4.0.2-protocol-relative-url-injection-via-namespace-in-interpolateurl"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108941","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 23, 2026, 12:55:09 PM","dateUpdated":"Oct 29, 2026, 1:19:15 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-108941","identifiers":["EUVD-2026-108941","CVE-2026-115730","GHSA-w47m-j727-m843","GHSA-9jhj-wvmw-cfx5"]},"retained":false,"historicalAffected":[]},{"revision":"680efb0b11dd484280b4fdff433d9565","observedAt":"2026-10-30T22:45:44.312+00:00","statement":{"source":"nvd","id":"CVE-2026-115730","aliases":[],"title":"i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-r…","description":"i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.","state":0,"publishedAt":"2026-10-23T13:17:08.887+00:00","modifiedAt":"2026-10-29T14:17:49.39+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":2.3,"severity":"LOW"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","score":3.1,"severity":"LOW"}],"references":["https://github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7","https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5","https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf","https://www.vulncheck.com/advisories/i18next-http-backend-4.0.2-protocol-relative-url-injection-via-namespace-in-interpolateurl"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115730","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-74"],"productCriteria":[],"sourceDates":{"published":"2026-10-23T13:17:08.887","lastModified":"2026-10-29T14:17:49.390"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-115730","identifiers":["CVE-2026-115730"]},"retained":false,"historicalAffected":[]},{"revision":"3fcb79890d094c0094a66fc8dedfcfc0","observedAt":"2026-10-28T21:55:29.474+00:00","statement":{"source":"osv","id":"GHSA-9jhj-wvmw-cfx5","aliases":["CVE-2026-115730"],"title":"i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)","description":"## Affected versions\nVerified on 4.0.2 (latest on npm) and on commit 07e0288 (the GHSA-xvq9-wjp8-hwqf fix). Earlier 3.x/4.x versions that allow `/` in ns are likely affected too. Not verified on them.\n\n## Impact\nSame class as GHSA-xvq9-wjp8-hwqf and GHSA-q89c-q3h5-w34g: when an attacker controls the namespace value, the request goes to an attacker-chosen origin. In a browser this loads attacker-controlled translation JSON (content injection into the UI, and XSS where translations are rendered as HTML). The precondition is a template with `{{ns}}` right after a leading `/`, for example `/{{ns}}/{{lng}}.json`. The 4.0.2 maintainer note says templates with a leading `/` are safe. This case is outside that statement.\n\n## Root cause\n`isSafeNsUrlSegment` rejects any ns containing `//`, but allows a single leading `/` (needed for nested namespaces like `a/b`). Interpolation into `/{{ns}}/...` puts the template's own `/` next to the value's `/`. The result starts with `//`, which is a protocol-relative URL. The check runs on the value, not on the final URL.\n\n## Minimal PoC\n```js\nimport Backend from 'i18next-http-backend'\nconst b = new Backend(null, { loadPath: '/{{ns}}/{{lng}}.json',\n  request: (opts, url, payload, cb) => { console.log(url, '->', new URL(url, 'https://app.example/').origin); cb(null, { status: 200, data: '{}' }) } })\nb.read('en', '/evil.example', () => {})\n```\nObserved on 4.0.2:\n```\nPOC ns=/evil.example  loadPath=/{{ns}}/{{lng}}.json => url=//evil.example/en.json  origin in page https://app.example/ = https://evil.example\n```\n\n## Negative controls (same run)\n- ns `//evil.example`: rejected (\"unsafe lng/ns value\").\n- lng `http:127.0.0.1:9` (the GHSA-xvq9 payload): rejected.\n- ns `common` and nested ns `a/b`: `common/en.json` and `a/b/en.json`, same origin.\n\n## Suggested fix\nValidate the final interpolated URL, not just the values: reject it if it starts with `//` or `\\`, or if it has a scheme or host the template did not have. The advisory already recommends this (\"parse the final URL and require it to remain within the intended origin and path\"). Alternatively, reject an ns that starts with `/`.\n\n## Disclosure\nWe intend to keep this private for 90 days from the date of the report, or until a fixed release is available, whichever comes first, and are happy to adjust if you need more time.\n\n## Re-verification\nRe-run on 2026-10-14 against the same latest release. The PoC still reproduces and the negative controls still hold.\n\nReported by Zachariah Mithani.\n\n## Maintainer note\n\nConfirmed and fixed in 4.0.3 (commit i18next/i18next-http-backend@042c3d4).\n\n**Preconditions.** The `loadPath` / `addPath` template must put `{{ns}}` directly after a leading `/` (for example `/{{ns}}/{{lng}}.json`), and the attacker must control the namespace value. Applications usually set namespaces in code rather than from user input. The default `/locales/{{lng}}/{{ns}}.json`, templates with an origin, and templates with a fixed path segment before `{{ns}}` are not affected. Only browsers are affected: in Node, `fetch('//host/...')` fails because there is no base URL to resolve against. XSS additionally requires the application to render translations as HTML.\n\n**Fix.** The 4.0.2 `//` check looked at each value on its own and could not see the `/` the template puts in front of it. `interpolateUrl` now also checks the interpolated URL: it may only start with `//` or `\\` if the template itself does. Protocol-relative CDN templates such as `//cdn.example/{{lng}}/{{ns}}.json` keep working.\n\n**Affected range.** Versions before 3.0.5 had no value validation at all and are reachable through this vector too, so the affected range is `< 4.0.3`.\n\n**Related.** i18next-fs-backend had the same class of problem for file paths (a leading `/` in `ns`, or `C:` in `lng`, changing the root of a path built from a template that starts with the placeholder). It is fixed in i18next-fs-backend 2.6.9.","state":0,"publishedAt":"2026-10-28T21:07:57+00:00","modifiedAt":"2026-10-28T21:15:05.1548155+00:00","affected":[{"ecosystem":"npm","name":"i18next-http-backend","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.0.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5","https://nvd.nist.gov/vuln/detail/CVE-2026-115730","https://github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7","https://github.com/i18next/i18next-http-backend","https://www.vulncheck.com/advisories/i18next-http-backend-4.0.2-protocol-relative-url-injection-via-namespace-in-interpolateurl"],"sourceUrl":"https://github.com/advisories/GHSA-9jhj-wvmw-cfx5","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9jhj-wvmw-cfx5","identifiers":["GHSA-9jhj-wvmw-cfx5","CVE-2026-115730"]},"retained":false,"historicalAffected":[]},{"revision":"7ebca73f44994ba98094438fba2a0638","observedAt":"2026-10-28T21:55:29.474+00:00","statement":{"source":"osv","id":"GHSA-w47m-j727-m843","aliases":[],"title":"Duplicate Advisory: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00A0GHSA-9jhj-wvmw-cfx5. This link is maintained to preserve external references.\n\n## Original Descriptioni18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.","state":2,"publishedAt":"2026-10-23T15:31:30+00:00","modifiedAt":"2026-10-28T21:15:04.1638517+00:00","affected":[{"ecosystem":"npm","name":"i18next-http-backend","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"4.0.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5","https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf","https://nvd.nist.gov/vuln/detail/CVE-2026-115730","https://github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7","https://www.vulncheck.com/advisories/i18next-http-backend-4.0.2-protocol-relative-url-injection-via-namespace-in-interpolateurl"],"sourceUrl":"https://github.com/advisories/GHSA-w47m-j727-m843","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-w47m-j727-m843","identifiers":["GHSA-w47m-j727-m843"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T09:27:02.0881180+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T09:27:02.088118+00:00","lastSuccessAt":"2026-11-07T09:27:02.275552+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:02.2755528+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-119922d4652e19b255c332c622ccf0862cc635682e2e6107e0a24821a354707e","complete":true,"records":420779,"lastAttemptAt":"2026-11-07T09:27:01.2826732+00:00","lastSuccessAt":"2026-11-07T09:27:01.2301134+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:01.2826732+00:00","snapshotPublishedAt":"2026-11-07T09:18:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c48116c2c5554f24a8286c6794ad8f98","complete":false,"records":13631,"lastAttemptAt":"2026-11-07T09:34:20.670127+00:00","lastSuccessAt":"2026-11-07T09:34:20.7686471+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:34:20.7686471+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T09:27:02.0881180+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T09:27:02.088118+00:00","lastSuccessAt":"2026-11-07T09:27:02.2763671+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:02.2763676+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1262a9fa83024e28a1560dfc0c9cdf3c","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T09:27:03.0678524+00:00","lastSuccessAt":"2026-11-07T06:27:08.533+00:00","error":null,"lastVerifiedAt":"2026-11-07T06:27:08.533+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T09:27:01.6721049+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:01.6721049+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T09:27:01.4581125+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:01.4581125+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T09:27:02.0484184+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:02.0484184+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-a0b728bc1c5526b5429930c00621636eba8655069c176697c3080f8377619ad7","complete":true,"records":231291,"lastAttemptAt":"2026-11-07T09:27:01.5654151+00:00","lastSuccessAt":"2026-11-07T00:28:51.1983528+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:01.5654151+00:00","snapshotPublishedAt":"2026-11-06T23:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}