Threats affecting pkg:npm/vue-i18n

CVE-2026-118257 is a high-severity cross-site scripting (XSS) vulnerability in the vue-i18n internationalization plugin for Vue.js. The flaw affects versions 9.14.5, 10.0.8, and versions from 11.1.10 up to but not including 11.4.14, as well as 12.0.0-alpha.4 up to but not including 12.0.0-alpha.5. The vulnerability arises because the sanitizeTranslatedHtml() function escapes markup and event-handler text inside an iframe srcdoc attribute but leaves the srcdoc attribute active, allowing browsers to parse attacker-controlled content as same-origin nested HTML. This can lead to script execution when escapeParameter is enabled and translations are rendered as HTML via v-html. The issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

A cross-site scripting (XSS) vulnerability exists in the vue-i18n internationalization plugin for Vue.js versions from 9.0.0-beta.5 up to but not including 11.4.14 and from 12.0.0-alpha.1 up to but not including 12.0.0-alpha.5. When the escapeParameter (escapeParameterHtml in the Legacy API) option is enabled, named interpolation values are not properly escaped if both list and named values are supplied in the same translation call. This can allow attacker-controlled HTML markup injection, potentially leading to phishing or script execution when combined with other issues. The vulnerability is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as <img src=x onerror=...>, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue.