CVE-2026-115730Low· 3.1▾ SunlitA flaw was found in i18next-http-backend. A remote attacker who can control namespace values can supply input starting with a slash to construct protocol-relative URLs in path templates. This flaw allows translation requests to be redirect…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 17.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
A flaw was found in i18next-http-backend. A remote attacker who can control namespace values can supply input starting with a slash to construct protocol-relative URLs in path templates. This flaw allows translation requests to be redirected to an attacker-controlled server, leading to cross-site scripting (XSS) and unauthorized user interface content injection.
i18next-http-backend: i18next-http-backend: Cross-site scripting via protocol-relative URL injection — rated Low by Red Hat. Released 2026-10-23.
Affected:
No fix planned:
Out of support scope
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-33230Medium· 6.1nltk: NLTK: Script execution via reflected cross-site scripting in WordNet Browser (CVE-2026-33230)
CVE-2026-116148Low· 3.6ImageMagick: ImageMagick: Command injection via unvalidated drawing options in MVG encoder (CVE-2026-116148)
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2026-115754Medium· 4.7serialize-javascript: serialize-javascript: Cross-site scripting via unescaped function serialization (CVE-2026-115754)
CVE-2026-115351Medium· 4.7mistune: mistune: Information disclosure via CSS injection in figure directive (CVE-2026-115351)
CVE-2026-115350Medium· 6.1mistune: mistune: Cross-site scripting via Include directive (CVE-2026-115350)