CyberRota Analysis
AI-GeneratedThe i18next-http-backend library versions prior to 4.0.2 are vulnerable to URL injection and server-side request forgery due to improper handling of attacker-controlled language or namespace values in custom load paths. This vulnerability allows malicious users to manipulate URLs, potentially leading to unauthorized access or data leakage. Organizations using affected versions of this library should prioritize upgrading to version 4.0.2 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.