Vue I18n CVE-2026-118256

Three concrete prerequisites must all hold: (1) the application enables escapeParameter (escapeParameterHtml in the Legacy API); (2) it renders translation output as HTML, e.g. with v-html; and (3) a single translate call supplies both a list and named values, e.g. t(key, ['...'], { named: { ... } }), where the named values are untrusted - because escapeParams() escapes the list branch OR the named branch (joined by else), the named values are then inserted unescaped. Limiting factors: active user interaction is required to view the rendered content (UI:A); escapeParameter is opt-in, not a default; component interpolation via <i18n-t> is NOT affected because it never passes both list and named and does not render HTML; by default the retained sanitizeTranslatedHtml() neutralizes event handlers and javascript: URLs, so script execution requires either versions without the sanitizer (before 9.14.5, 10.0.8, 11.1.10, and 12.0.0-alpha.1 to alpha.3) or chaining with the iframe srcdoc bypass (GHSA-83rm-6c8r-g728). The vendor states the complete fix is updating to 11.4.14 or 12.0.0-alpha.5; documented workarounds are not passing list and named in the same call when escapeParameter is enabled, and not rendering untrusted translations with v-html (use <i18n-t> instead).

This is a low-priority issue, consistent with the vuln.today Decision label of 'monitor' and the input CVSS 4.0 base score of 2.1. The vector (AV:N/AC:L/AT:P/PR:N/UI:A) shows a network-reachable flaw requiring active user interaction and a specific attack requirement (AT:P), with impact limited to subsequent-system integrity (SI:L) - the injected markup affects the rendered page, not confidentiality or availability. No EPSS score and no KEV status are present in the input, so there is no signal of widespread or confirmed exploitation; exploitation status is best described as a public PoC reference existing (demonstration code is in the GHSA advisory) that is not verified as a weaponized working exploit. The real-world risk is gated heavily by non-default preconditions: the application must enable the opt-in escapeParameter/escapeParameterHtml option, render translations as HTML via v-html, and pass both a list and untrusted named values in the same translate call. Even then, the retained sanitizeTranslatedHtml() (from CVE-2025-53892) neutralizes event-handler attributes and javascript: URLs, so by default the primary impact is markup injection (phishing links, forms, layout changes); full script execution (DOM-based XSS) occurs only on versions without the sanitizer or when chained with the iframe srcdoc bypass (GHSA-83rm-6c8r-g728). Net: a genuine but narrow XSS requiring an unusual code pattern - a 'fix during routine updates' item, not an emergency.

An application enables escapeParameter and renders a translation through v-html, invoking something like t(key, ['...'], { named: { field: untrustedValue } }). Because escapeParams() escapes only the list branch (the branches are joined by else), the attacker-controlled named value reaches the DOM as raw markup - a phishing link or form - and on releases without the sanitizer, or combined with the iframe srcdoc bypass, injected script executes in the victim's browser. A PoC demonstrating the unescaped named value is published in the GHSA-8rc2-428q-7ww3 advisory.