Vulnerability-Lookup

CVE-2026-118256 (GCVE-0-2026-118256)

Vulnerability from cvelistv5 – Published: 2026-10-28 18:20 – Updated: 2026-10-30 14:19

Title

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

Summary

Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-30 14:19 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-116 - Improper Encoding or Escaping of Output

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8044 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/intlify/vue-i18n/security/advi…	x_refsource_CONFIRM
https://github.com/intlify/vue-i18n/pull/2680	x_refsource_MISC
https://github.com/intlify/vue-i18n/commit/d657ce…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
intlify	vue-i18n	Affected: >= 9.0.0-beta.5, < 11.4.14 Affected: >= 12.0.0-alpha.1, < 12.0.0-alpha.5	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118256",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T14:19:23.592827Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T14:19:32.716Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vue-i18n",
          "vendor": "intlify",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 9.0.0-beta.5, \u003c 11.4.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 12.0.0-alpha.1, \u003c 12.0.0-alpha.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T18:20:14.644Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3"
        },
        {
          "name": "https://github.com/intlify/vue-i18n/pull/2680",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/intlify/vue-i18n/pull/2680"
        },
        {
          "name": "https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8"
        }
      ],
      "source": {
        "advisory": "GHSA-8rc2-428q-7ww3",
        "discovery": "UNKNOWN"
      },
      "title": "Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-118256",
    "datePublished": "2026-10-28T18:20:14.644Z",
    "dateReserved": "2026-10-27T20:13:55.314Z",
    "dateUpdated": "2026-10-30T14:19:32.716Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-118256",
      "date": "2026-10-30",
      "epss": "0.0048",
      "percentile": "0.41435"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "vue-i18n",
                "vendor": "intlify",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 9.0.0-beta.5, \u003c 11.4.14"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 12.0.0-alpha.1, \u003c 12.0.0-alpha.5"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5."
          }
        ],
        "id": "CVE-2026-118256",
        "lastModified": "2026-10-30T15:16:47.017",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 2.1,
                "baseSeverity": "LOW",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "LOW",
                "userInteraction": "ACTIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-118256",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T14:19:23.592827Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-28T19:17:30.060",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/intlify/vue-i18n/pull/2680"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              },
              {
                "lang": "en",
                "value": "CWE-116"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-30T06:14:41+00:00",
      "cve": "CVE-2026-118256",
      "id": "CVE-2026-118256",
      "initial_release_date": "2026-10-28T18:20:14.644000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "vue-i18n: vue-i18n: HTML injection via unescaped named interpolation parameters",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-118256.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-118256",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-30T14:19:23.592827Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-30T14:19:05.458Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "vue-i18n",
              "vendor": "intlify",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 9.0.0-beta.5, \u003c 11.4.14"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 12.0.0-alpha.1, \u003c 12.0.0-alpha.5"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 2.1,
                "baseSeverity": "LOW",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "LOW",
                "userInteraction": "ACTIVE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-116",
                  "description": "CWE-116: Improper Encoding or Escaping of Output",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-28T18:20:14.644Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3"
            },
            {
              "name": "https://github.com/intlify/vue-i18n/pull/2680",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/intlify/vue-i18n/pull/2680"
            },
            {
              "name": "https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8"
            }
          ],
          "source": {
            "advisory": "GHSA-8rc2-428q-7ww3",
            "discovery": "UNKNOWN"
          },
          "title": "Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-118256",
        "datePublished": "2026-10-28T18:20:14.644Z",
        "dateReserved": "2026-10-27T20:13:55.314Z",
        "dateUpdated": "2026-10-30T14:19:32.716Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-118256

Vulnerability from fkie_nvd - Published: 2026-10-28 19:17 - Updated: 2026-10-30 15:16

Severity

2.1 (Low) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8
	security-advisories@github.com	https://github.com/intlify/vue-i18n/pull/2680
	security-advisories@github.com	https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "vue-i18n",
          "vendor": "intlify",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 9.0.0-beta.5, \u003c 11.4.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 12.0.0-alpha.1, \u003c 12.0.0-alpha.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5."
    }
  ],
  "id": "CVE-2026-118256",
  "lastModified": "2026-10-30T15:16:47.017",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.1,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "LOW",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-118256",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-30T14:19:23.592827Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-28T19:17:30.060",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/intlify/vue-i18n/pull/2680"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-8RC2-428Q-7WW3

Vulnerability from github – Published: 2026-10-28 21:06 – Updated: 2026-10-28 21:06

Summary

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

Details

Summary

When escapeParameter is enabled (escapeParameterHtml in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. escapeParams() escapes either the list values or the named values, but not both: the two branches are joined by else. When a single call passes both, for example t(key, ['...'], { named: { ... } }), the named values reach the message without being escaped.

Details

escapeParams() in packages/core-base/src/translate.ts (v11.4.13):

function escapeParams(options: TranslateOptions) {
  if (isArray(options.list)) {
    options.list = options.list.map(item => (isString(item) ? escapeHtml(item) : item))
  } else if (isObject(options.named)) {
    // ...escapes the named values
  }
}

t(key, list, options) is a public overload, and TranslateOptions has a named field, so a call can carry both. The list is checked first, and the named values are then left as they are.

The translated string still goes through sanitizeTranslatedHtml() (added for CVE-2025-53892), which neutralizes event handler attributes and javascript: URLs. Other markup in the named values, such as links and forms, is inserted as is. Before the fix for GHSA-83rm-6c8r-g728, an <iframe srcdoc> in a named value also passes the sanitizer, and script runs. Versions without the sanitizer (before 9.14.5, 10.0.8 and 11.1.10, and 12.0.0-alpha.1 to alpha.3) insert the named values as HTML without any further check.

<i18n-t> is not affected: it passes either list or named values, never both, and it does not render translations as HTML.

PoC

import { createI18n } from 'vue-i18n'

const i18n = createI18n({
  legacy: false,
  locale: 'en',
  escapeParameter: true,
  messages: {
    en: { withList: '{0} {name}', withoutList: '{name}' }
  }
})
const t = i18n.global.t

t('withoutList', { name: '<b>x</b>' })
// &lt;b&gt;x&lt;&#x2F;b&gt;      escaped

t('withList', ['a'], { named: { name: '<b>x</b>' } })
// a <b>x</b>                   not escaped (v11.4.13)

Impact

Applications are affected when they enable escapeParameter, render translations as HTML (for example with v-html), and pass untrusted named values in the same call as a list. The named values are inserted as markup: phishing links, forms, or layout changes. Together with GHSA-83rm-6c8r-g728, or on versions without the sanitizer, this leads to script execution (DOM-based XSS).

Patches

Fixed in 11.4.14 and 12.0.0-alpha.5. escapeParams() now escapes both the list and the named values.

The fix also stops rewriting the named object that the caller passes. Before, the values of that object were replaced with their escaped form, so a second call with the same object escaped them twice.

v9 and v10 are no longer supported and will not be fixed. Please migrate to v11.

Workarounds

Do not pass list and named values in the same call when escapeParameter is enabled.
Do not render translations that can contain untrusted values with v-html. Use component interpolation (<i18n-t>) instead.

Severity

2.1 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "vue-i18n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0-beta.5"
            },
            {
              "fixed": "11.4.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vue-i18n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.0.0-alpha.1"
            },
            {
              "fixed": "12.0.0-alpha.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0-beta.10"
            },
            {
              "fixed": "11.4.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.0.0-alpha.1"
            },
            {
              "fixed": "12.0.0-alpha.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/core-base"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0-beta.12"
            },
            {
              "fixed": "11.4.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/core-base"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.0.0-alpha.1"
            },
            {
              "fixed": "12.0.0-alpha.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "petite-vue-i18n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.2.0-alpha.7"
            },
            {
              "fixed": "11.4.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "petite-vue-i18n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.0.0-alpha.1"
            },
            {
              "fixed": "12.0.0-alpha.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/vue-i18n-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.2.0-alpha.7"
            },
            {
              "fixed": "11.4.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/vue-i18n-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.0.0-alpha.1"
            },
            {
              "fixed": "12.0.0-alpha.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-118256"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-28T21:06:34Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Summary\n\nWhen `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. `escapeParams()` escapes either the list values or the named values, but not both: the two branches are joined by `else`. When a single call passes both, for example `t(key, [\u0027...\u0027], { named: { ... } })`, the named values reach the message without being escaped.\n\n### Details\n\n`escapeParams()` in [`packages/core-base/src/translate.ts` (v11.4.13)](https://github.com/intlify/vue-i18n/blob/v11.4.13/packages/core-base/src/translate.ts):\n\n```ts\nfunction escapeParams(options: TranslateOptions) {\n  if (isArray(options.list)) {\n    options.list = options.list.map(item =\u003e (isString(item) ? escapeHtml(item) : item))\n  } else if (isObject(options.named)) {\n    // ...escapes the named values\n  }\n}\n```\n\n`t(key, list, options)` is a public overload, and `TranslateOptions` has a `named` field, so a call can carry both. The list is checked first, and the named values are then left as they are.\n\nThe translated string still goes through `sanitizeTranslatedHtml()` (added for CVE-2025-53892), which neutralizes event handler attributes and `javascript:` URLs. Other markup in the named values, such as links and forms, is inserted as is. Before the fix for GHSA-83rm-6c8r-g728, an `\u003ciframe srcdoc\u003e` in a named value also passes the sanitizer, and script runs. Versions without the sanitizer (before 9.14.5, 10.0.8 and 11.1.10, and 12.0.0-alpha.1 to alpha.3) insert the named values as HTML without any further check.\n\n`\u003ci18n-t\u003e` is not affected: it passes either list or named values, never both, and it does not render translations as HTML.\n\n### PoC\n\n```js\nimport { createI18n } from \u0027vue-i18n\u0027\n\nconst i18n = createI18n({\n  legacy: false,\n  locale: \u0027en\u0027,\n  escapeParameter: true,\n  messages: {\n    en: { withList: \u0027{0} {name}\u0027, withoutList: \u0027{name}\u0027 }\n  }\n})\nconst t = i18n.global.t\n\nt(\u0027withoutList\u0027, { name: \u0027\u003cb\u003ex\u003c/b\u003e\u0027 })\n// \u0026lt;b\u0026gt;x\u0026lt;\u0026#x2F;b\u0026gt;      escaped\n\nt(\u0027withList\u0027, [\u0027a\u0027], { named: { name: \u0027\u003cb\u003ex\u003c/b\u003e\u0027 } })\n// a \u003cb\u003ex\u003c/b\u003e                   not escaped (v11.4.13)\n```\n\n### Impact\n\nApplications are affected when they enable `escapeParameter`, render translations as HTML (for example with `v-html`), and pass untrusted named values in the same call as a list. The named values are inserted as markup: phishing links, forms, or layout changes. Together with GHSA-83rm-6c8r-g728, or on versions without the sanitizer, this leads to script execution (DOM-based XSS).\n\n### Patches\n\nFixed in 11.4.14 and 12.0.0-alpha.5. `escapeParams()` now escapes both the list and the named values.\n\nThe fix also stops rewriting the named object that the caller passes. Before, the values of that object were replaced with their escaped form, so a second call with the same object escaped them twice.\n\nv9 and v10 are no longer supported and will not be fixed. Please migrate to v11.\n\n### Workarounds\n\n- Do not pass list and named values in the same call when `escapeParameter` is enabled.\n- Do not render translations that can contain untrusted values with `v-html`. Use component interpolation (`\u003ci18n-t\u003e`) instead.",
  "id": "GHSA-8rc2-428q-7ww3",
  "modified": "2026-10-28T21:06:34Z",
  "published": "2026-10-28T21:06:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/intlify/vue-i18n/pull/2680"
    },
    {
      "type": "WEB",
      "url": "https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/intlify/vue-i18n"
    },
    {
      "type": "WEB",
      "url": "https://github.com/intlify/vue-i18n/releases/tag/v11.4.14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-118256 (GCVE-0-2026-118256)

FKIE_CVE-2026-118256

GHSA-8RC2-428Q-7WW3

Summary

Details

PoC

Impact

Patches

Workarounds

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour