Vue I18n CVE-2026-118257

Exploitation requires all of the following in the host application: (1) escapeParameter enabled (escapeParameterHtml in the Legacy API), which routes the translated string through sanitizeTranslatedHtml(); (2) the application renders translations as HTML, for example via v-html; and (3) attacker-controlled content reaches an <iframe srcdoc="..."> value - reachable three ways per the advisory: an untrusted parameter the message places inside srcdoc, untrusted/crowdsourced or stored message content that itself contains <iframe srcdoc>, or untrusted named values passed in the same call as a list (GHSA-8rc2-428q-7ww3, where named values are not escaped). Limiting factors: this is not a default-configuration flaw - apps that do not enable escapeParameter, do not render translations with v-html, or keep srcdoc out of translations are unaffected, and rendering through the <i18n-t> component (component interpolation) is explicitly not affected. The vendor notes v9 and v10 will not be fixed and advises migrating to v11.

Signals point to a real but conditional, non-urgent issue rather than a top-tier emergency. The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, i.e. network vector, low complexity, PR:N (unauthenticated per the vector), and a scope change reflecting that injected script executes in the victim's browser origin. However, the official vector does not capture the dominant limiting factor documented in the GHSA advisory: exploitation only works when the host application enables escapeParameter (escapeParameterHtml in the Legacy API) AND renders translations as HTML through v-html AND lets untrusted content reach an iframe srcdoc value - a configuration the vendor documentation explicitly warns against. That heavily narrows real-world exposure, so the headline High score overstates the risk for typical deployments. No EPSS score is provided and the CVE is not in CISA KEV, so there is no evidence of active or widespread exploitation; the signal set shows no active-exploitation indicators. A PoC reference exists in the GHSA advisory (a short JavaScript snippet demonstrating the sanitizer bypass); it is not verified as a working weaponized exploit. The vuln.today decision label is 'this_week', consistent with a conditional DOM-XSS sanitizer-bypass that maintainers have already patched. Net: treat as a prompt patch/review item for apps using the vulnerable HTML-rendering pattern, not a drop-everything emergency.

An attacker places an <iframe srcdoc="..."> payload into untrusted content that a Vue app renders - for example a crowdsourced or stored translation string, or a user-controlled parameter that the message inserts inside srcdoc. In an app that enables escapeParameter and renders the translation via v-html, sanitizeTranslatedHtml() escapes the value and neutralizes on* handlers but leaves the srcdoc attribute active, so the browser entity-decodes the value, parses it as a same-origin nested document, and runs the attacker's script (DOM-based XSS). A PoC demonstrating the sanitizer bypass is published in the GHSA advisory.