{"id":"CVE-2026-118257","aliases":["EUVD-2026-112359","GHSA-83rm-6c8r-g728","ROOT-APP-NPM-CVE-2026-118257"],"status":"published","title":"Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages","description":"Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00272,"percentile":0.19816,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116","CWE-79"],"published":"2026-10-28T18:23:49Z","modified":"2026-10-31T02:30:32Z","fixes":[{"ecosystem":"npm","package":"vue-i18n","fixed_in":["11.4.14","12.0.0-alpha.5"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"petite-vue-i18n","fixed_in":["11.4.14","12.0.0-alpha.5"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@intlify/core-base","fixed_in":["11.4.14","12.0.0-alpha.5"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@intlify/core","fixed_in":["11.4.14","12.0.0-alpha.5"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@intlify/vue-i18n-core","fixed_in":["11.4.14","12.0.0-alpha.5"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@intlify/shared","fixed_in":["11.4.14","12.0.0-alpha.5"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"@intlify/shared","fixed_in":["11.4.5-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@intlify/core-base","fixed_in":["11.4.5-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"vue-i18n","fixed_in":["11.4.5-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/intlify__shared","fixed_in":["11.4.5-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/intlify__core-base","fixed_in":["11.4.5-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/vue-i18n","fixed_in":["11.4.5-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vue-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.14.5"},{"last_affected":"9.14.5"}]}],"versions":["9.14.5"]},{"source":"ghsa","ecosystem":"npm","package":"vue-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.8"},{"last_affected":"10.0.8"}]}],"versions":["10.0.8"]},{"source":"ghsa","ecosystem":"npm","package":"vue-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.1.10"},{"fixed":"11.4.14"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vue-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0-alpha.4"},{"last_affected":"12.0.0-alpha.4"},{"fixed":"12.0.0-alpha.5"}]}],"versions":["12.0.0-alpha.4"]},{"source":"ghsa","ecosystem":"npm","package":"petite-vue-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.14.5"},{"last_affected":"9.14.5"}]}],"versions":["9.14.5"]},{"source":"ghsa","ecosystem":"npm","package":"petite-vue-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.8"},{"last_affected":"10.0.8"}]}],"versions":["10.0.8"]},{"source":"ghsa","ecosystem":"npm","package":"petite-vue-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.1.10"},{"fixed":"11.4.14"}]}]},{"source":"ghsa","ecosystem":"npm","package":"petite-vue-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0-alpha.4"},{"last_affected":"12.0.0-alpha.4"},{"fixed":"12.0.0-alpha.5"}]}],"versions":["12.0.0-alpha.4"]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/core-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.14.5"},{"last_affected":"9.14.5"}]}],"versions":["9.14.5"]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/core-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.8"},{"last_affected":"10.0.8"}]}],"versions":["10.0.8"]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/core-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.1.10"},{"fixed":"11.4.14"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/core-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0-alpha.4"},{"last_affected":"12.0.0-alpha.4"},{"fixed":"12.0.0-alpha.5"}]}],"versions":["12.0.0-alpha.4"]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.14.5"},{"last_affected":"9.14.5"}]}],"versions":["9.14.5"]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.8"},{"last_affected":"10.0.8"}]}],"versions":["10.0.8"]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.1.10"},{"fixed":"11.4.14"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0-alpha.4"},{"last_affected":"12.0.0-alpha.4"},{"fixed":"12.0.0-alpha.5"}]}],"versions":["12.0.0-alpha.4"]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/vue-i18n-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.14.5"},{"last_affected":"9.14.5"}]}],"versions":["9.14.5"]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/vue-i18n-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.8"},{"last_affected":"10.0.8"}]}],"versions":["10.0.8"]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/vue-i18n-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.1.10"},{"fixed":"11.4.14"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/vue-i18n-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0-alpha.4"},{"last_affected":"12.0.0-alpha.4"},{"fixed":"12.0.0-alpha.5"}]}],"versions":["12.0.0-alpha.4"]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/shared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.14.5"},{"last_affected":"9.14.5"}]}],"versions":["9.14.5"]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/shared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.8"},{"last_affected":"10.0.8"}]}],"versions":["10.0.8"]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/shared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.1.10"},{"fixed":"11.4.14"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@intlify/shared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0-alpha.4"},{"last_affected":"12.0.0-alpha.4"},{"fixed":"12.0.0-alpha.5"}]}],"versions":["12.0.0-alpha.4"]},{"source":"osv","ecosystem":"npm","package":"vue-i18n","versions":["9.14.5"]},{"source":"osv","ecosystem":"npm","package":"vue-i18n","versions":["10.0.8"]},{"source":"osv","ecosystem":"npm","package":"vue-i18n","ranges":[{"type":"SEMVER","events":[{"introduced":"11.1.10"},{"fixed":"11.4.14"}]}]},{"source":"osv","ecosystem":"npm","package":"vue-i18n","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0-alpha.4"},{"fixed":"12.0.0-alpha.5"}]}],"versions":["12.0.0-alpha.4"]},{"source":"osv","ecosystem":"npm","package":"petite-vue-i18n","versions":["9.14.5"]},{"source":"osv","ecosystem":"npm","package":"petite-vue-i18n","versions":["10.0.8"]},{"source":"osv","ecosystem":"npm","package":"petite-vue-i18n","ranges":[{"type":"SEMVER","events":[{"introduced":"11.1.10"},{"fixed":"11.4.14"}]}]},{"source":"osv","ecosystem":"npm","package":"petite-vue-i18n","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0-alpha.4"},{"fixed":"12.0.0-alpha.5"}]}],"versions":["12.0.0-alpha.4"]},{"source":"osv","ecosystem":"npm","package":"@intlify/core-base","versions":["9.14.5"]},{"source":"osv","ecosystem":"npm","package":"@intlify/core-base","versions":["10.0.8"]},{"source":"osv","ecosystem":"npm","package":"@intlify/core-base","ranges":[{"type":"SEMVER","events":[{"introduced":"11.1.10"},{"fixed":"11.4.14"}]}]},{"source":"osv","ecosystem":"npm","package":"@intlify/core-base","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0-alpha.4"},{"fixed":"12.0.0-alpha.5"}]}],"versions":["12.0.0-alpha.4"]},{"source":"osv","ecosystem":"npm","package":"@intlify/core","versions":["9.14.5"]},{"source":"osv","ecosystem":"npm","package":"@intlify/core","versions":["10.0.8"]},{"source":"osv","ecosystem":"npm","package":"@intlify/core","ranges":[{"type":"SEMVER","events":[{"introduced":"11.1.10"},{"fixed":"11.4.14"}]}]},{"source":"osv","ecosystem":"npm","package":"@intlify/core","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0-alpha.4"},{"fixed":"12.0.0-alpha.5"}]}],"versions":["12.0.0-alpha.4"]},{"source":"osv","ecosystem":"npm","package":"@intlify/vue-i18n-core","versions":["9.14.5"]},{"source":"osv","ecosystem":"npm","package":"@intlify/vue-i18n-core","versions":["10.0.8"]},{"source":"osv","ecosystem":"npm","package":"@intlify/vue-i18n-core","ranges":[{"type":"SEMVER","events":[{"introduced":"11.1.10"},{"fixed":"11.4.14"}]}]},{"source":"osv","ecosystem":"npm","package":"@intlify/vue-i18n-core","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0-alpha.4"},{"fixed":"12.0.0-alpha.5"}]}],"versions":["12.0.0-alpha.4"]},{"source":"osv","ecosystem":"npm","package":"@intlify/shared","versions":["9.14.5"]},{"source":"osv","ecosystem":"npm","package":"@intlify/shared","versions":["10.0.8"]},{"source":"osv","ecosystem":"npm","package":"@intlify/shared","ranges":[{"type":"SEMVER","events":[{"introduced":"11.1.10"},{"fixed":"11.4.14"}]}]},{"source":"osv","ecosystem":"npm","package":"@intlify/shared","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0-alpha.4"},{"fixed":"12.0.0-alpha.5"}]}],"versions":["12.0.0-alpha.4"]},{"source":"osv","ecosystem":"Root:npm","package":"@intlify/shared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.5-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@intlify/core-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.5-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"vue-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.5-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/intlify__shared","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.5-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/intlify__core-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.5-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/vue-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.5-root.io.1"}]}]}],"products":[{"vendor":"intlify","product":"vue-i18n"}],"references":[{"url":"https://github.com/intlify/vue-i18n/security/advisories/GHSA-83rm-6c8r-g728","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/intlify/vue-i18n/pull/2679","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/intlify/vue-i18n/commit/43391d20e7c85403cb59bdb21b5d542819f54042","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/intlify/vue-i18n/releases/tag/v11.4.14","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-83rm-6c8r-g728"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118257.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118257","tags":["advisory"]},{"url":"https://github.com/intlify/vue-i18n","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-118257","title":"Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages","description":"Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.","status":"published","published":"2026-10-28T18:23:49.4Z","modified":"2026-10-29T20:55:05.78Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79","CWE-116"],"updated_at":"2026-11-02T14:20:04.156238Z"}],"euvd":[{"id":"EUVD-2026-112359","description":"Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.","status":"published","published":"2026-10-28T18:23:49Z","modified":"2026-10-29T20:55:05Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T16:59:14.591479Z"}],"ghsa":[{"id":"GHSA-83rm-6c8r-g728","title":"Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages","description":"### Summary\n\nWhen `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n passes the translated string through `sanitizeTranslatedHtml()`. The sanitizer escapes `\u003c` and `\u003e` in attribute values and neutralizes event handler attributes such as `onerror`, but it does not handle the `srcdoc` attribute of `\u003ciframe\u003e`.\n\nThe value of `srcdoc` is an HTML document: the browser decodes the character references in it and parses the result as a nested document in the same origin. The escaping and the neutralization done by the sanitizer are both character references, so they are undone inside `srcdoc`. This bypasses the fix for CVE-2025-53892 (GHSA-x8qp-wqqm-57ph).\n\n### Details\n\n`sanitizeTranslatedHtml()` ([`packages/shared/src/sanitize.ts` in v11.4.13](https://github.com/intlify/vue-i18n/blob/v11.4.13/packages/shared/src/sanitize.ts#L126-L162)) works on the final translated string:\n\n1. It escapes `\u003c`, `\u003e`, `\"` and `'` inside quoted attribute values.\n2. It rewrites the `on` of event handler attributes to `\u0026#111;n`.\n3. It replaces `javascript:` URLs in `href`, `src`, `action` and `formaction` with `about:blank`.\n\nInside `srcdoc`, steps 1 and 2 only produce character references, which the browser decodes before parsing the value as a document. Markup inside `srcdoc` therefore survives the sanitizer, with escaping or without it.\n\nThis can be reached in three ways:\n\n- **A parameter inside `srcdoc`.** With a message such as `\u003ciframe srcdoc=\"{content}\"\u003e\u003c/iframe\u003e`, `escapeParameter` escapes `content` into character references, and the browser decodes them again.\n- **Markup in a message.** A message that contains an `\u003ciframe srcdoc=\"...\"\u003e` keeps it after sanitizing. The documentation asks not to use HTML messages with content from users, but it also says that the sanitizer neutralizes event handlers in the final HTML.\n- **Together with GHSA-8rc2-428q-7ww3.** When a call passes a list and named values, the named values are not escaped. An `\u003ciframe srcdoc=\"...\"\u003e` in a named value then reaches the sanitizer as markup, even with an ordinary message such as `{0} {name}`.\n\n### PoC\n\n```js\nimport { createI18n } from 'vue-i18n'\n\nconst i18n = createI18n({\n  legacy: false,\n  locale: 'en',\n  escapeParameter: true,\n  messages: {\n    en: { message: '\u003ciframe srcdoc=\"\u003cb\u003ex\u003c/b\u003e\"\u003e\u003c/iframe\u003e' }\n  }\n})\n\nconsole.log(i18n.global.t('message'))\n// v11.4.13: \u003ciframe srcdoc=\"\u0026lt;b\u0026gt;x\u0026lt;/b\u0026gt;\"\u003e\u003c/iframe\u003e\n```\n\nThe browser decodes the value and renders `\u003cb\u003ex\u003c/b\u003e` as a separate document inside the `\u003ciframe\u003e`, in the same origin as the page. Any markup in that position is parsed the same way.\n\n### Impact\n\nApplications are affected when they enable `escapeParameter`, render translations as HTML (for example with `v-html`), and one of the following applies:\n\n- an untrusted value is passed as a parameter that the message places inside `srcdoc`,\n- message content is not fully trusted (for example crowdsourced or stored translations), or\n- untrusted named values are passed in the same call as a list (GHSA-8rc2-428q-7ww3).\n\nAn attacker can then run script in the origin of the application (DOM-based XSS), despite the sanitizer.\n\nRendering through `\u003ci18n-t\u003e` is not affected, since it does not render translations as HTML.\n\n### Patches\n\nFixed in 11.4.14 and 12.0.0-alpha.5. The sanitizer now neutralizes the `srcdoc` attribute itself, in the same way as event handler attributes.\n\nv9 and v10 are no longer supported and will not be fixed. Please migrate to v11.\n\n### Workarounds\n\n- Do not render translations that can contain untrusted content with `v-html`. Use component interpolation (`\u003ci18n-t\u003e`) instead.\n- Do not put `srcdoc` in translation messages, and do not pass values into it.\n\n### References\n\n- [CWE-79](https://cwe.mitre.org/data/definitions/79.html), [CWE-116](https://cwe.mitre.org/data/definitions/116.html)\n- [GHSA-x8qp-wqqm-57ph](https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph) (CVE-2025-53892): the fix that added `sanitizeTranslatedHtml()`\n- [GHSA-8rc2-428q-7ww3](https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3): named values are not escaped when a list is also passed\n- [HTML Standard: the `srcdoc` attribute](https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-srcdoc)","status":"published","published":"2026-10-28T21:06:24Z","modified":"2026-10-28T21:06:25Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-79","CWE-116"],"updated_at":"2026-11-02T14:41:39.926569Z"}],"nvd":[{"id":"CVE-2026-118257","description":"Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.","status":"published","published":"2026-10-28T19:17:30.207Z","modified":"2026-10-29T21:17:15.557Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-79","CWE-116"],"updated_at":"2026-11-02T14:13:04.6346Z"}],"osv":[{"id":"CVE-2026-118257","title":"Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages","description":"Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.","status":"published","published":"2026-10-28T18:23:49.4Z","modified":"2026-10-31T02:30:32.963493385Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-116","CWE-79"],"updated_at":"2026-11-02T15:44:57.008854Z"},{"id":"GHSA-83rm-6c8r-g728","title":"Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages","description":"### Summary\n\nWhen `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n passes the translated string through `sanitizeTranslatedHtml()`. The sanitizer escapes `\u003c` and `\u003e` in attribute values and neutralizes event handler attributes such as `onerror`, but it does not handle the `srcdoc` attribute of `\u003ciframe\u003e`.\n\nThe value of `srcdoc` is an HTML document: the browser decodes the character references in it and parses the result as a nested document in the same origin. The escaping and the neutralization done by the sanitizer are both character references, so they are undone inside `srcdoc`. This bypasses the fix for CVE-2025-53892 (GHSA-x8qp-wqqm-57ph).\n\n### Details\n\n`sanitizeTranslatedHtml()` ([`packages/shared/src/sanitize.ts` in v11.4.13](https://github.com/intlify/vue-i18n/blob/v11.4.13/packages/shared/src/sanitize.ts#L126-L162)) works on the final translated string:\n\n1. It escapes `\u003c`, `\u003e`, `\"` and `'` inside quoted attribute values.\n2. It rewrites the `on` of event handler attributes to `\u0026#111;n`.\n3. It replaces `javascript:` URLs in `href`, `src`, `action` and `formaction` with `about:blank`.\n\nInside `srcdoc`, steps 1 and 2 only produce character references, which the browser decodes before parsing the value as a document. Markup inside `srcdoc` therefore survives the sanitizer, with escaping or without it.\n\nThis can be reached in three ways:\n\n- **A parameter inside `srcdoc`.** With a message such as `\u003ciframe srcdoc=\"{content}\"\u003e\u003c/iframe\u003e`, `escapeParameter` escapes `content` into character references, and the browser decodes them again.\n- **Markup in a message.** A message that contains an `\u003ciframe srcdoc=\"...\"\u003e` keeps it after sanitizing. The documentation asks not to use HTML messages with content from users, but it also says that the sanitizer neutralizes event handlers in the final HTML.\n- **Together with GHSA-8rc2-428q-7ww3.** When a call passes a list and named values, the named values are not escaped. An `\u003ciframe srcdoc=\"...\"\u003e` in a named value then reaches the sanitizer as markup, even with an ordinary message such as `{0} {name}`.\n\n### PoC\n\n```js\nimport { createI18n } from 'vue-i18n'\n\nconst i18n = createI18n({\n  legacy: false,\n  locale: 'en',\n  escapeParameter: true,\n  messages: {\n    en: { message: '\u003ciframe srcdoc=\"\u003cb\u003ex\u003c/b\u003e\"\u003e\u003c/iframe\u003e' }\n  }\n})\n\nconsole.log(i18n.global.t('message'))\n// v11.4.13: \u003ciframe srcdoc=\"\u0026lt;b\u0026gt;x\u0026lt;/b\u0026gt;\"\u003e\u003c/iframe\u003e\n```\n\nThe browser decodes the value and renders `\u003cb\u003ex\u003c/b\u003e` as a separate document inside the `\u003ciframe\u003e`, in the same origin as the page. Any markup in that position is parsed the same way.\n\n### Impact\n\nApplications are affected when they enable `escapeParameter`, render translations as HTML (for example with `v-html`), and one of the following applies:\n\n- an untrusted value is passed as a parameter that the message places inside `srcdoc`,\n- message content is not fully trusted (for example crowdsourced or stored translations), or\n- untrusted named values are passed in the same call as a list (GHSA-8rc2-428q-7ww3).\n\nAn attacker can then run script in the origin of the application (DOM-based XSS), despite the sanitizer.\n\nRendering through `\u003ci18n-t\u003e` is not affected, since it does not render translations as HTML.\n\n### Patches\n\nFixed in 11.4.14 and 12.0.0-alpha.5. The sanitizer now neutralizes the `srcdoc` attribute itself, in the same way as event handler attributes.\n\nv9 and v10 are no longer supported and will not be fixed. Please migrate to v11.\n\n### Workarounds\n\n- Do not render translations that can contain untrusted content with `v-html`. Use component interpolation (`\u003ci18n-t\u003e`) instead.\n- Do not put `srcdoc` in translation messages, and do not pass values into it.\n\n### References\n\n- [CWE-79](https://cwe.mitre.org/data/definitions/79.html), [CWE-116](https://cwe.mitre.org/data/definitions/116.html)\n- [GHSA-x8qp-wqqm-57ph](https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph) (CVE-2025-53892): the fix that added `sanitizeTranslatedHtml()`\n- [GHSA-8rc2-428q-7ww3](https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3): named values are not escaped when a list is also passed\n- [HTML Standard: the `srcdoc` attribute](https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-srcdoc)","status":"published","published":"2026-10-28T21:06:24Z","modified":"2026-10-28T21:15:05.568930892Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-116","CWE-79"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"ROOT-APP-NPM-CVE-2026-118257","title":"CVE-2026-118257 in @intlify/shared - Patched by Root","description":"Root has patched CVE-2026-118257 in the @intlify/shared package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-30T10:16:55Z","modified":"2026-10-30T11:15:02.407228909Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}