high · 7.2 Partly patched

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

CVE-2026-118257 · GHSA-83rm-6c8r-g728 · published 28 Oct 2026

How serious is it

  • Severity: high, CVSS score 7.2 out of 10.
  • No exploit prediction (EPSS) score yet.
  • Not on the CISA list of exploited vulnerabilities.
  • No public exploit in Exploit-DB.

Is your app affected by CVE-2026-118257?

Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.

Who is affected

  • vue-i18n (npm) = 9.14.5
  • vue-i18n (npm) = 10.0.8
  • vue-i18n (npm) >= 11.1.10, < 11.4.14
  • vue-i18n (npm) = 12.0.0-alpha.4
  • petite-vue-i18n (npm) = 9.14.5
  • petite-vue-i18n (npm) = 10.0.8
  • petite-vue-i18n (npm) >= 11.1.10, < 11.4.14
  • petite-vue-i18n (npm) = 12.0.0-alpha.4
  • @intlify/core-base (npm) = 9.14.5
  • @intlify/core-base (npm) = 10.0.8
  • @intlify/core-base (npm) >= 11.1.10, < 11.4.14
  • @intlify/core-base (npm) = 12.0.0-alpha.4
  • @intlify/core (npm) = 9.14.5
  • @intlify/core (npm) = 10.0.8
  • @intlify/core (npm) >= 11.1.10, < 11.4.14
  • @intlify/core (npm) = 12.0.0-alpha.4
  • @intlify/vue-i18n-core (npm) = 9.14.5
  • @intlify/vue-i18n-core (npm) = 10.0.8
  • @intlify/vue-i18n-core (npm) >= 11.1.10, < 11.4.14
  • @intlify/vue-i18n-core (npm) = 12.0.0-alpha.4
  • @intlify/shared (npm) = 9.14.5
  • @intlify/shared (npm) = 10.0.8
  • @intlify/shared (npm) >= 11.1.10, < 11.4.14
  • @intlify/shared (npm) = 12.0.0-alpha.4

How to check

  1. Run npm ls vue-i18n in your project to see the installed version, including copies pulled in by other packages.
  2. Run npm ls petite-vue-i18n in your project to see the installed version, including copies pulled in by other packages.
  3. Run npm ls @intlify/core-base in your project to see the installed version, including copies pulled in by other packages.
  4. Run npm ls @intlify/core in your project to see the installed version, including copies pulled in by other packages.
  5. Run npm ls @intlify/vue-i18n-core in your project to see the installed version, including copies pulled in by other packages.
  6. Run npm ls @intlify/shared in your project to see the installed version, including copies pulled in by other packages.
  7. Or paste your lockfile into the checker: it lists every package with a known vulnerability, this one included.
  8. Or run npx shippable-dev scan localhost:3000 in your project folder. It reads your lockfile and flags this vulnerability along with every other known one.

How to fix

Copies a prompt for Claude Code, Cursor or Codex: it checks your lockfiles for this and upgrades it.
  1. No fixed version of vue-i18n yet. Replace or remove it, or apply the workaround in the advisory below.
  2. No fixed version of vue-i18n yet. Replace or remove it, or apply the workaround in the advisory below.
  3. On >= 11.1.10, < 11.4.14: Upgrade vue-i18n to 11.4.14 or later, commit the lockfile and redeploy.
  4. On = 12.0.0-alpha.4: Upgrade vue-i18n to 12.0.0-alpha.5 or later, commit the lockfile and redeploy.
  5. No fixed version of petite-vue-i18n yet. Replace or remove it, or apply the workaround in the advisory below.
  6. No fixed version of petite-vue-i18n yet. Replace or remove it, or apply the workaround in the advisory below.
  7. On >= 11.1.10, < 11.4.14: Upgrade petite-vue-i18n to 11.4.14 or later, commit the lockfile and redeploy.
  8. On = 12.0.0-alpha.4: Upgrade petite-vue-i18n to 12.0.0-alpha.5 or later, commit the lockfile and redeploy.
  9. No fixed version of @intlify/core-base yet. Replace or remove it, or apply the workaround in the advisory below.
  10. No fixed version of @intlify/core-base yet. Replace or remove it, or apply the workaround in the advisory below.
  11. On >= 11.1.10, < 11.4.14: Upgrade @intlify/core-base to 11.4.14 or later, commit the lockfile and redeploy.
  12. On = 12.0.0-alpha.4: Upgrade @intlify/core-base to 12.0.0-alpha.5 or later, commit the lockfile and redeploy.
  13. No fixed version of @intlify/core yet. Replace or remove it, or apply the workaround in the advisory below.
  14. No fixed version of @intlify/core yet. Replace or remove it, or apply the workaround in the advisory below.
  15. On >= 11.1.10, < 11.4.14: Upgrade @intlify/core to 11.4.14 or later, commit the lockfile and redeploy.
  16. On = 12.0.0-alpha.4: Upgrade @intlify/core to 12.0.0-alpha.5 or later, commit the lockfile and redeploy.
  17. No fixed version of @intlify/vue-i18n-core yet. Replace or remove it, or apply the workaround in the advisory below.
  18. No fixed version of @intlify/vue-i18n-core yet. Replace or remove it, or apply the workaround in the advisory below.
  19. On >= 11.1.10, < 11.4.14: Upgrade @intlify/vue-i18n-core to 11.4.14 or later, commit the lockfile and redeploy.
  20. On = 12.0.0-alpha.4: Upgrade @intlify/vue-i18n-core to 12.0.0-alpha.5 or later, commit the lockfile and redeploy.
  21. No fixed version of @intlify/shared yet. Replace or remove it, or apply the workaround in the advisory below.
  22. No fixed version of @intlify/shared yet. Replace or remove it, or apply the workaround in the advisory below.
  23. On >= 11.1.10, < 11.4.14: Upgrade @intlify/shared to 11.4.14 or later, commit the lockfile and redeploy.
  24. On = 12.0.0-alpha.4: Upgrade @intlify/shared to 12.0.0-alpha.5 or later, commit the lockfile and redeploy.
  25. If a vulnerable version was live, check your logs and rotate the secrets that server could read.

The advisory

### Summary When `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n passes the translated string through `sanitizeTranslatedHtml()`. The sanitizer escapes `<` and `>` in attribute values and neutralizes event handler attributes such as `onerror`, but it does not handle the `srcdoc` attribute of `<iframe>`. The value of `srcdoc` is an HTML document: the browser decodes the character references in it and parses the result as a nested document in the same origin. The escaping and the neutralization done by the sanitizer are both character references, so they are undone inside `srcdoc`. This bypasses the fix for CVE-2025-53892 (GHSA-x8qp-wqqm-57ph). ### Details `sanitizeTranslatedHtml()` ([`packages/shared/src/sanitize.ts` in v11.4.13](https://github.com/intlify/vue-i18n/blob/v11.4.13/packages/shared/src/sanitize.ts#L126-L162)) works on the final translated string: 1. It escapes `<`, `>`, `"` and `'` inside quoted attribute values. 2. It rewrites the `on` of event handler attributes to `&#111;n`. 3. It replaces `javascript:` URLs in `href`, `src`, `action` and `formaction` with `about:blank`. Inside `srcdoc`, steps 1 and 2 only produce character references, which the browser decodes before parsing the value as a document. Markup inside `srcdoc` therefore survives the sanitizer, with escaping or without it. This can be reached in three ways: - **A parameter inside `srcdoc`.** With a message such as `<iframe srcdoc="{content}"></iframe>`, `escapeParameter` escapes `content` into character references, and the browser decodes them again. - **Markup in a message.** A message that contains an `<iframe srcdoc="...">` keeps it after sanitizing. The documentation asks not to use HTML messages with content from users, but it also says that the sanitizer neutralizes event handlers in the final HTML. - **Together with GHSA-8rc2-428q-7ww3.** When a call passes a list and named values, the named values are not escaped. An `<iframe srcdoc="...">` in a named value then reaches the sanitizer as markup, even with an ordinary message such as `{0} {name}`. ### PoC ```js import { createI18n } from 'vue-i18n' const i18n = createI18n({ legacy: false, locale: 'en', escapeParameter: true, messages: { en: { message: '<iframe srcdoc="<b>x</b>"></iframe>' } } }) console.log(i18n.global.t('message')) // v11.4.13: <iframe srcdoc="&lt;b&gt;x&lt;/b&gt;"></iframe> ``` The browser decodes the value and renders `<b>x</b>` as a separate document inside the `<iframe>`, in the same origin as the page. Any markup in that position is parsed the same way. ### Impact Applications are affected when they enable `escapeParameter`, render translations as HTML (for example with `v-html`), and one of the following applies: - an untrusted value is passed as a parameter that the message places inside `srcdoc`, - message content is not fully trusted (for example crowdsourced or stored translations), or - untrusted named values are passed in the same call as a list (GHSA-8rc2-428q-7ww3). An attacker can then run script in the origin of the application (DOM-based XSS), despite the sanitizer. Rendering through `<i18n-t>` is not affected, since it does not render translations as HTML. ### Patches Fixed in 11.4.14 and 12.0.0-alpha.5. The sanitizer now neutralizes the `srcdoc` attribute itself, in the same way as event handler attributes. v9 and v10 are no longer supported and will not be fixed. Please migrate to v11. ### Workarounds - Do not render translations that can contain untrusted content with `v-html`. Use component interpolation (`<i18n-t>`) instead. - Do not put `srcdoc` in translation messages, and do not pass values into it. ### References - [CWE-79](https://cwe.mitre.org/data/definitions/79.html), [CWE-116](https://cwe.mitre.org/data/definitions/116.html) - [GHSA-x8qp-wqqm-57ph](https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph) (CVE-2025-53892): the fix that added `sanitizeTranslatedHtml()` - [GHSA-8rc2-428q-7ww3](https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3): named values are not escaped when a list is also passed - [HTML Standard: the `srcdoc` attribute](https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-srcdoc)

Check your whole app

Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.

References

Merged from GitHub Advisory Database, OSV. Last updated 29 Oct 2026. All vulnerabilities · RSS · JSON

Get alerts for new exploited vulnerabilities