{"schema":"threatline.record/2","record":{"id":"CVE-2026-118257","aliases":["GHSA-83rm-6c8r-g728"],"summary":"Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages","details":"Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.","categories":["Frameworks"],"product":"vue-i18n","vendor":"intlify","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118257","source_modified_at":"2026-10-28T18:23:49.400Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"vue-i18n","vendor":"intlify","versions":[{"version":"= 9.14.5","status":"affected"},{"version":"= 10.0.8","status":"affected"},{"version":">= 11.1.10, < 11.4.14","status":"affected"},{"version":">= 12.0.0-alpha.4, < 12.0.0-alpha.5","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":7.2,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T18:23:49.400Z","modified_at":"2026-10-28T18:23:49.400Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-118257","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T18:23:49.400Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/intlify/vue-i18n/security/advisories/GHSA-83rm-6c8r-g728","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/intlify/vue-i18n/pull/2679","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/intlify/vue-i18n/commit/43391d20e7c85403cb59bdb21b5d542819f54042","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/intlify/vue-i18n/releases/tag/v11.4.14","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T18:23:49.400Z","content_hash":"eab4f4a2f9f8fbc11cd97981e30a0ddddc593a750353a169a7c9c2bdf2449faf"}}