All vulnerabilities
CVE-2026-118257GHSA-83rm-6c8r-g728

vue-i18n: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

intlify vue-i18nFrameworks
Open in ThreatlineRecord JSON
CVSS
7.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Text from CVE List

Affected versions 4

  • vue-i18naffected: = 9.14.5CVE List
  • vue-i18naffected: = 10.0.8CVE List
  • vue-i18naffected: >= 11.1.10, < 11.4.14CVE List
  • vue-i18naffected: >= 12.0.0-alpha.4, < 12.0.0-alpha.5CVE List

References 5