CVE-2026-115730: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in i18next i18next-http-backend

The vulnerability in i18next-http-backend 4.0.2 arises from an incomplete fix in the interpolateUrl() function. Attackers who can control the namespace (ns) parameter can supply a value starting with a slash, which allows them to form protocol-relative URLs within loadPath or addPath templates. This enables the loading of malicious translations hosted by the attacker, resulting in UI content injection and potential cross-site scripting attacks. The affected versions are >=4.0.2 and <4.0.3.

An attacker able to control the namespace value can redirect translation requests to attacker-controlled servers, leading to injection of malicious UI content and cross-site scripting. This could impact the integrity and security of the user interface, potentially allowing execution of arbitrary scripts in the context of the affected application. The CVSS 4.0 score is 2.3, indicating low severity with network attack vector, low complexity, and requiring user interaction and partial impact on integrity.

A fix is available in versions 4.0.3 and later. Users should upgrade i18next-http-backend to version 4.0.3 or above to remediate this vulnerability. No additional mitigations are specified in the provided data.