The i18next-http-backend library versions before 3.0.5 interpolate user-controllable language and namespace parameters directly into URL templates without proper encoding or path sanitization. This improper limitation of pathname allows attackers to inject characters that alter the URL structure, enabling path traversal and broader URL injection attacks. The vulnerability is addressed by the interpolateUrl sanitization fix introduced in version 3.0.5. Users unable to upgrade immediately can mitigate by sanitizing inputs to strip characters such as '..', '/', '\', '?', '#', '%', whitespace, and control characters, and by capping input length.

An attacker can manipulate the language or namespace parameters to craft URLs that traverse directories or alter URL structure, potentially leading to unauthorized access to resources or unintended backend requests. The CVSS score of 6.5 (medium severity) reflects limited confidentiality and integrity impact without privilege or user interaction requirements. There are no known exploits in the wild at this time.

A fixed version 3.0.5 of i18next-http-backend is available and should be applied to remediate this vulnerability. If immediate upgrading is not possible, users should sanitize the lng and ns inputs before they reach i18next by removing characters such as '..', '/', '\', '?', '#', '%', whitespace, and control characters, and by limiting the length of these inputs. This workaround reduces the risk until the official fix can be deployed.