---
id: CVE-2026-115730
title: >-
  i18next-http-backend: i18next-http-backend: Cross-site scripting via
  protocol-relative URL injection (CVE-2026-115730)
summary: >-
  A flaw was found in i18next-http-backend. A remote attacker who can control
  namespace values can supply input starting with a slash to construct
  protocol-relative URLs in path templates. This flaw allows translation
  requests to be redirect…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N'
cvssSource: vendor
cwe:
  - CWE-79
  - CWE-74
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
affected:
  - migration_toolkit_for_applications 8
  - multicluster_engine_for_kubernetes
  - network_observability_operator
  - openshift_service_mesh 3
  - advanced_cluster_management_for_kubernetes 2
  - amq_broker 7
  - ansible_automation_platform 2
  - data_grid 8
  - edge_manager 1
  - openshift_container_platform 4
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T17:18:17+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115730.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115730.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-115730'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2559717'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-115730'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-115730'
  - url: >-
      https://github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7
  - url: >-
      https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5
  - url: >-
      https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf
  - url: >-
      https://www.vulncheck.com/advisories/i18next-http-backend-4.0.2-protocol-relative-url-injection-via-namespace-in-interpolateurl
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
ingestedAt: '2026-10-23T13:24:55.508Z'
---

## Overview

A flaw was found in i18next-http-backend. A remote attacker who can control namespace values can supply input starting with a slash to construct protocol-relative URLs in path templates. This flaw allows translation requests to be redirected to an attacker-controlled server, leading to cross-site scripting (XSS) and unauthorized user interface content injection.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Migration Toolkit for Applications 8, Multicluster Engine for Kubernetes, Network Observability Operator, OpenShift Service Mesh 3, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat AMQ Broker 7, … · no fix planned: OpenShift Service Mesh 3, Red Hat Ansible Automation Platform 2, Red Hat Edge Manager 1, Migration Toolkit for Applications 8, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115730.json)

**i18next-http-backend: i18next-http-backend: Cross-site scripting via protocol-relative URL injection** — rated Low by Red Hat. Released 2026-10-23.

Affected:

- Migration Toolkit for Applications 8
- Multicluster Engine for Kubernetes
- Network Observability Operator
- OpenShift Service Mesh 3
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat AMQ Broker 7
- Red Hat Ansible Automation Platform 2
- Red Hat Data Grid 8
- Red Hat Edge Manager 1
- Red Hat OpenShift Container Platform 4

No fix planned:

- OpenShift Service Mesh 3
- Red Hat Ansible Automation Platform 2
- Red Hat Edge Manager 1
- Migration Toolkit for Applications 8
- Multicluster Engine for Kubernetes
- Network Observability Operator
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat AMQ Broker 7
- Red Hat Data Grid 8
- Red Hat OpenShift Container Platform 4

## Remediation

Out of support scope