Vue I18N
Monthly
DOM-based cross-site scripting in Vue I18n's sanitizeTranslatedHtml() lets attacker-influenced content survive sanitization when it is placed inside an <iframe srcdoc="..."> value: the sanitizer escapes markup and neutralizes on* handlers using character references, but the browser re-decodes that value and parses it as a same-origin nested document, so the injected markup executes script. Applications are exposed only in a specific configuration - escapeParameter (escapeParameterHtml in the Legacy API) enabled, translations rendered as HTML (for example with v-html), and untrusted data reaching an srcdoc value via a parameter, untrusted/stored message content, or unescaped named values passed alongside a list (GHSA-8rc2-428q-7ww3) - while rendering through <i18n-t> is not affected. Affected ranges are vue-i18n 11.1.10 through 11.4.13 and 12.0.0-alpha.4, with unsupported 9.14.5 and 10.0.8 also vulnerable and left unfixed; the vendor advisory includes a public PoC snippet illustrating the bypass, which is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing).
Cross-site scripting in the Vue I18n internationalization plugin (npm vue-i18n, plus @intlify/core and @intlify/core-base) from 9.0.0-beta.5 up to 11.4.13 and in the 12.0.0-alpha line up to alpha.4 allows attacker-supplied markup to reach HTML-rendered translations when escapeParameter (escapeParameterHtml in the Legacy API) is enabled and one translate call supplies both a list and named values. The vendor advisory includes a PoC reference; it is not verified as working exploit code, and no public exploit or active exploitation is recorded at time of analysis (CISA KEV: no; vuln.today decision label: monitor, CVSS 4.0 base 2.1). Impact is limited: three prerequisites must all hold (escapeParameter enabled, translations rendered as HTML such as via v-html, and untrusted named values passed alongside a list), user interaction is required, and the retained sanitizeTranslatedHtml() normally strips event handlers and javascript: URLs, so script execution only follows on builds without the sanitizer or by chaining the iframe srcdoc bypass GHSA-83rm-6c8r-g728; realistic outcomes without that chain are injected phishing links, forms and layout changes.
DOM-based cross-site scripting in Vue I18n's sanitizeTranslatedHtml() lets attacker-influenced content survive sanitization when it is placed inside an <iframe srcdoc="..."> value: the sanitizer escapes markup and neutralizes on* handlers using character references, but the browser re-decodes that value and parses it as a same-origin nested document, so the injected markup executes script. Applications are exposed only in a specific configuration - escapeParameter (escapeParameterHtml in the Legacy API) enabled, translations rendered as HTML (for example with v-html), and untrusted data reaching an srcdoc value via a parameter, untrusted/stored message content, or unescaped named values passed alongside a list (GHSA-8rc2-428q-7ww3) - while rendering through <i18n-t> is not affected. Affected ranges are vue-i18n 11.1.10 through 11.4.13 and 12.0.0-alpha.4, with unsupported 9.14.5 and 10.0.8 also vulnerable and left unfixed; the vendor advisory includes a public PoC snippet illustrating the bypass, which is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing).
Cross-site scripting in the Vue I18n internationalization plugin (npm vue-i18n, plus @intlify/core and @intlify/core-base) from 9.0.0-beta.5 up to 11.4.13 and in the 12.0.0-alpha line up to alpha.4 allows attacker-supplied markup to reach HTML-rendered translations when escapeParameter (escapeParameterHtml in the Legacy API) is enabled and one translate call supplies both a list and named values. The vendor advisory includes a PoC reference; it is not verified as working exploit code, and no public exploit or active exploitation is recorded at time of analysis (CISA KEV: no; vuln.today decision label: monitor, CVSS 4.0 base 2.1). Impact is limited: three prerequisites must all hold (escapeParameter enabled, translations rendered as HTML such as via v-html, and untrusted named values passed alongside a list), user interaction is required, and the retained sanitizeTranslatedHtml() normally strips event handlers and javascript: URLs, so script execution only follows on builds without the sanitizer or by chaining the iframe srcdoc bypass GHSA-83rm-6c8r-g728; realistic outcomes without that chain are injected phishing links, forms and layout changes.