intlify @intlify/core vulnerabilities

Latest intlify @intlify/core CVEs

Newest publication first

1. CVE-2026-118257 Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

   Published 2026-10-28

   High·CVSS 7.2 EPSS 0.27%

   Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode th...

2. CVE-2026-118256 Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

   Published 2026-10-28

   Low·CVSS 2.1 EPSS 0.48%

   Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and nam...

3. CVE-2025-53892 Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror

   Published 2025-07-16

   Medium·CVSS 5.3 EPSS 0.81%

   Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0,...

4. CVE-2025-27597 Vue I18n Prototype Pollution in `handleFlatJson`

   Published 2025-03-07

   High·CVSS 8.9 EPSS 0.63%

   Vue I18n is the internationalization plugin for Vue.js. @intlify/message-resolver and @intlify/vue-i18n-core are vulnerable to Prototype Pollution through the entry function: handleFlatJson. An attacker can supply a payload with Object.prototype setter to introduce or modify prop...

5. CVE-2024-52809 Cross-site Scripting vulnerability with prototype pollution in vue-i18n

   Published 2024-11-29

   Medium·CVSS 5.3 EPSS 0.67%

   vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to createI18n or useI18n. When locale message ASTs are generated in development mode there is a possibility of Cross-site Scripting attack. This issue has been addre...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.