i18next-http-backend 4.0.2 contains an incomplete fix in the interpolateUrl function that permits attackers to supply a namespace value beginning with a slash. This causes the library to build a protocol‑relative URL in the loadPath or addPath templates, allowing an attacker to point translation requests to malicious servers and inject arbitrary content into the user interface, creating a cross‑site scripting vulnerability.

The vulnerability affects the i18next-http-backend library from the i18next project, specifically version 4.0.2. No other versions are listed as affected in the CNA data.

Based on the description, the CVSS base score of 2.3 indicates limited overall impact, but the vulnerability permits attackers to craft protocol-relative URLs. The likely attack vector is remote manipulation of the namespace parameter within translation requests, which may be achieved via crafted URLs or API calls to the target application. After the legitimate translation engine resolves the URL, it will fetch data from an attacker‑controlled server, allowing injection of malicious UI content and potential cross‑site scripting. The absence of an EPSS score means the likelihood of automated exploitation is uncertain, and the vulnerability is not listed in KEV. Applications that expose translation requests to untrusted input are at moderate risk.