{"id":"CVE-2025-53892","aliases":["EUVD-2025-21704","GHSA-x8qp-wqqm-57ph"],"status":"published","title":"Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror","description":"Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as \u003cimg src=x onerror=...\u003e, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00808,"percentile":0.57337,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2025-07-16T13:42:09Z","modified":"2026-10-28T02:30:41Z","fixes":[{"ecosystem":"npm","package":"vue-i18n","fixed_in":["9.14.5","10.0.8","11.1.10"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@intlify/core","fixed_in":["9.14.5","10.0.8","11.1.10"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@intlify/core-base","fixed_in":["9.14.5","10.0.8","11.1.10"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@intlify/vue-i18n-core","fixed_in":["9.14.5","10.0.8","11.1.10"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"petite-vue-i18n","fixed_in":["10.0.8","11.1.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vue-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.14.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vue-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vue-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.1.10"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.14.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.1.10"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/core-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.14.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/core-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/core-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.1.10"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/vue-i18n-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.2.0"},{"fixed":"9.14.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/vue-i18n-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/vue-i18n-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.1.10"}]}]},{"source":"ghsa","ecosystem":"npm","package":"petite-vue-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"petite-vue-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.1.10"}]}]},{"source":"osv","ecosystem":"npm","package":"vue-i18n","ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.14.5"}]}]},{"source":"osv","ecosystem":"npm","package":"vue-i18n","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"vue-i18n","ranges":[{"type":"SEMVER","events":[{"introduced":"11.0.0"},{"fixed":"11.1.10"}]}]},{"source":"osv","ecosystem":"npm","package":"@intlify/core","ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.14.5"}]}]},{"source":"osv","ecosystem":"npm","package":"@intlify/core","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"@intlify/core","ranges":[{"type":"SEMVER","events":[{"introduced":"11.0.0"},{"fixed":"11.1.10"}]}]},{"source":"osv","ecosystem":"npm","package":"@intlify/core-base","ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.14.5"}]}]},{"source":"osv","ecosystem":"npm","package":"@intlify/core-base","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"@intlify/core-base","ranges":[{"type":"SEMVER","events":[{"introduced":"11.0.0"},{"fixed":"11.1.10"}]}]},{"source":"osv","ecosystem":"npm","package":"@intlify/vue-i18n-core","ranges":[{"type":"SEMVER","events":[{"introduced":"9.2.0"},{"fixed":"9.14.5"}]}]},{"source":"osv","ecosystem":"npm","package":"@intlify/vue-i18n-core","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"@intlify/vue-i18n-core","ranges":[{"type":"SEMVER","events":[{"introduced":"11.0.0"},{"fixed":"11.1.10"}]}]},{"source":"osv","ecosystem":"npm","package":"petite-vue-i18n","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"petite-vue-i18n","ranges":[{"type":"SEMVER","events":[{"introduced":"11.0.0"},{"fixed":"11.1.10"}]}]}],"products":[{"vendor":"intlify","product":"vue-i18n"}],"references":[{"url":"https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/intlify/vue-i18n/pull/2229","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/intlify/vue-i18n/pull/2230","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/intlify/vue-i18n/commit/49f982443ab8fd94ecc427b265ce97d57df94d7e","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/intlify/vue-i18n/commit/a47099619fb9b256e86341a8658ebe72e92ab099","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/intlify/vue-i18n/releases/tag/v10.0.8","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/intlify/vue-i18n/releases/tag/v11.1.10","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/intlify/vue-i18n/releases/tag/v9.14.5","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53892","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x8qp-wqqm-57ph"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53892.json","tags":["advisory"]},{"url":"https://github.com/intlify/vue-i18n","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-53892","title":"Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror","description":"Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as \u003cimg src=x onerror=...\u003e, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue.","status":"published","published":"2025-07-16T13:42:09.383Z","modified":"2025-07-22T14:58:34.382Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:49.180768Z"}],"euvd":[{"id":"EUVD-2025-21704","description":"Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as \u003cimg src=x onerror=...\u003e, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue.","status":"published","published":"2025-07-16T13:42:09Z","modified":"2025-07-22T14:58:34Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:32:05.744165Z"}],"ghsa":[{"id":"GHSA-x8qp-wqqm-57ph","title":"vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes","description":"### Summary\nThe escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution of certain tag-based payloads, such as `\u003cimg src=x onerror=...\u003e`, if the interpolated value is inserted inside an HTML context using v-html.\n\nThis may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html.\n\n### Details\n\nWhen escapeParameterHtml: true is enabled, it correctly escapes common injection points.\n\nHowever, it does not sanitize entire attribute contexts, which can be used as XSS vectors via:\n\n`\u003cimg src=x onerror=alert(1)\u003e\n`\n### PoC\nIn your Vue I18n configuration:\n\n```\nconst i18n = createI18n({\n  escapeParameterHtml: true,\n  messages: {\n    en: {\n      vulnerable: 'Caution: \u003cimg src=x onerror=\"{payload}\"\u003e'\n    }\n  }\n});\n```\nUse this interpolated payload:\n\n`const payload = '\u003cscript\u003ealert(\"xss\")\u003c/script\u003e';`\nRender the translation using v-html (even not using v-html):\n\n`\u003cp v-html=\"$t('vulnerable', { payload })\"\u003e\u003c/p\u003e\n`\nExpected: escaped content should render as text, not execute.\n\nActual: script executes in some environments (or the payload is partially parsed as HTML).\n\n### Impact\n\nThis creates a DOM-based Cross-Site Scripting (XSS) vulnerability despite enabling a security option (escapeParameterHtml) .","status":"published","published":"2025-07-16T19:32:48Z","modified":"2025-07-17T20:58:50Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:50.834587Z"}],"nvd":[{"id":"CVE-2025-53892","description":"Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as \u003cimg src=x onerror=...\u003e, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue.","status":"published","published":"2025-07-16T14:15:28.357Z","modified":"2026-06-17T09:39:05.34Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:18.782156Z"}],"osv":[{"id":"CVE-2025-53892","title":"Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror","description":"Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as \u003cimg src=x onerror=...\u003e, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue.","status":"published","published":"2025-07-16T13:42:09.383Z","modified":"2026-10-28T02:30:41.23353987Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:50.45326Z"},{"id":"GHSA-x8qp-wqqm-57ph","title":"vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes","description":"### Summary\nThe escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution of certain tag-based payloads, such as `\u003cimg src=x onerror=...\u003e`, if the interpolated value is inserted inside an HTML context using v-html.\n\nThis may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html.\n\n### Details\n\nWhen escapeParameterHtml: true is enabled, it correctly escapes common injection points.\n\nHowever, it does not sanitize entire attribute contexts, which can be used as XSS vectors via:\n\n`\u003cimg src=x onerror=alert(1)\u003e\n`\n### PoC\nIn your Vue I18n configuration:\n\n```\nconst i18n = createI18n({\n  escapeParameterHtml: true,\n  messages: {\n    en: {\n      vulnerable: 'Caution: \u003cimg src=x onerror=\"{payload}\"\u003e'\n    }\n  }\n});\n```\nUse this interpolated payload:\n\n`const payload = '\u003cscript\u003ealert(\"xss\")\u003c/script\u003e';`\nRender the translation using v-html (even not using v-html):\n\n`\u003cp v-html=\"$t('vulnerable', { payload })\"\u003e\u003c/p\u003e\n`\nExpected: escaped content should render as text, not execute.\n\nActual: script executes in some environments (or the payload is partially parsed as HTML).\n\n### Impact\n\nThis creates a DOM-based Cross-Site Scripting (XSS) vulnerability despite enabling a security option (escapeParameterHtml) .","status":"published","published":"2025-07-16T19:32:48Z","modified":"2026-09-10T03:50:57.972539838Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:59.835583Z"}]}}