i18next-http-backend EUVD-2026-108941

Three conditions must all hold, per the vendor advisory: (1) the loadPath or addPath template must place {{ns}} directly after a leading '/', e.g. '/{{ns}}/{{lng}}.json'; (2) the attacker must control the namespace (ns) value, which applications usually set in code rather than from user input; and (3) the code must run in a browser, because in Node fetch('//host/...') fails with no base URL to resolve against. For the result to be XSS rather than mere content injection, the application must additionally render translations as HTML. Explicitly NOT affected (confirmed by the maintainer): the default template '/locales/{{lng}}/{{ns}}.json', any template with an origin, any template with a fixed path segment before {{ns}}, and protocol-relative CDN templates like '//cdn.example/{{lng}}/{{ns}}.json'. An ns of '//evil.example' is rejected by the per-value check; only a single leading '/' (allowed for nested namespaces like 'a/b') slips through.

All signals converge on LOW real-world priority. The supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N) scores only 2.3: network-reachable and unauthenticated, but with an attack requirement (AT:P) and passive user interaction (UI:P), and impact limited to low integrity on the vulnerable system (VI:L) - no confidentiality or availability impact. The vuln.today decision label is 'monitor', consistent with the low score. A working PoC exists and was re-verified reproducing on 2026-10-14, but the input provides no EPSS score and the CVE is not in CISA KEV, so there is no evidence of widespread or active exploitation - PoC availability and active exploitation are distinct, and only the former is present here. The decisive risk limiter is the narrow precondition stack confirmed by the maintainer: the app must use a loadPath/addPath template placing {{ns}} directly after a leading slash, the attacker must control the namespace value (which applications typically set in code, not from user input), only browsers are affected (Node fetch of '//host' fails with no base URL), and XSS additionally requires the app to render translations as HTML. This is a genuine but conditional flaw, not a high-urgency issue. No signals conflict; the main gap is that no EPSS value was supplied.

An application running i18next-http-backend < 4.0.3 in a browser with a template like '/{{ns}}/{{lng}}.json' derives its namespace from attacker-influenced input; the attacker supplies ns='/evil.example', which joins the template's leading slash into '//evil.example/en.json', a protocol-relative URL the browser resolves to the attacker's origin and fetches as translation JSON. The attacker-hosted translations inject content into the UI, becoming stored XSS wherever the app renders translations as HTML. A minimal PoC is published in the advisory and was re-verified reproducing on 2026-10-14.