CVE-2026-115730

What it actually does

Incomplete sanitization in interpolateUrl() permits an ns parameter beginning with a slash to produce protocol-relative URLs inside loadPath or addPath templates, causing the library to fetch translation resources from an attacker-controlled origin and return attacker-supplied strings for UI rendering.

Why it matters to the business

Attackers can alter displayed text or inject executable scripts into the application interface, enabling phishing, credential theft, or unauthorized actions performed by users who trust the application's content.

How an attack unfolds

An attacker who can influence the namespace value supplied to i18next sends a request containing an ns parameter that begins with a slash. The library concatenates this value into a protocol-relative URL within the configured loadPath or addPath template, causing the browser to retrieve translation data from the attacker's host. The attacker returns a malicious translation file containing script payloads that are rendered directly into the DOM, achieving content injection or cross-site scripting.

How to fix it

Upgrade i18next-http-backend to a version that fully validates and rejects namespace values beginning with a slash or other scheme indicators before interpolation. If an upgrade is unavailable, implement server-side or client-side validation that strips or blocks leading slashes and protocol-relative prefixes from all namespace inputs before they reach the library.

How to confirm the fix worked

Review the interpolateUrl implementation to confirm that namespace values are normalized to remove leading slashes and are rejected when they would form protocol-relative or absolute URLs. Test by supplying ns values such as /evil and verifying that the resulting load URL remains within the expected origin.

Typical attack path

1. Identify an endpoint that accepts a controllable ns parameter and triggers translation loading
2. Craft an ns value that begins with a forward slash and produces a protocol-relative URL when interpolated
3. Force the client to load the translation resource from an attacker-controlled domain
4. Return a translation payload containing executable script or malicious markup
5. Achieve UI content injection or cross-site scripting when the translation is rendered

How to detect it

Inspect web server or application logs for translation requests containing an ns parameter that starts with a forward slash. Correlate such requests with subsequent outbound fetches to unexpected domains or responses containing script tags or unusual markup in translation payloads.

• ns=/
• loadPath containing //
• addPath containing //

What your security team should do

• Prioritize upgrade of i18next-http-backend once a corrected release is published
• Add input validation rules that sanitize or reject ns parameters containing leading slashes or URL scheme indicators
• Monitor translation load requests for ns values that begin with a slash or produce external origins
• Review applications that expose namespace selection to untrusted users and restrict the set of allowed values