Read the docs
TI-2024-35322 Aliases CVE-2024-52810GHSA-hjwq-mjwj-4x6c

Prototype Pollution in @intlify/shared >=9.7.0 <= 10.0.4

Priority HIGH 70CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

@intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared (10.0.4) is vulnerable to Prototype Pollution through the entry function(s) lib.deepCopy. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) as the minimum consequence. Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context. This issue has been addressed in versions 9.14.2, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00767 55th percentileScored 2026-11-07
Fix Fixed vue-i18n (intlify): 9.14.2, 10.0.5@intlify/shared (npm): 9.14.2, 10.0.5+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
intlifyvue-i18n9.7.0 to before 9.14.2; 10.0.0 to before 10.0.59.14.2, 10.0.5Patch availableCNA
—@intlify/shared (npm)9.7.0 to before 9.14.29.14.2Patch availableGHSA-hjwq-mjwj-4x6c
—@intlify/vue-i18n-core (npm)9.7.0 to before 9.14.29.14.2Patch availableGHSA-hjwq-mjwj-4x6c
—vue-i18n (npm)9.7.0 to before 9.14.29.14.2Patch availableGHSA-hjwq-mjwj-4x6c
—petite-vue-i18n (npm)10.0.0 to before 10.0.510.0.5Patch availableGHSA-hjwq-mjwj-4x6c
—@intlify/shared (npm)10.0.0 to before 10.0.510.0.5Patch availableGHSA-hjwq-mjwj-4x6c
—@intlify/vue-i18n-core (npm)10.0.0 to before 10.0.510.0.5Patch availableGHSA-hjwq-mjwj-4x6c
—vue-i18n (npm)10.0.0 to before 10.0.510.0.5Patch availableGHSA-hjwq-mjwj-4x6c
  • vue-i18n Vendorintlify Affected 9.7.0 to before 9.14.2; 10.0.0 to before 10.0.5 Fixed in 9.14.2, 10.0.5 Patch available CNA
  • @intlify/shared (npm) Vendor— Affected 9.7.0 to before 9.14.2 Fixed in 9.14.2 Patch available GHSA-hjwq-mjwj-4x6c
  • @intlify/vue-i18n-core (npm) Vendor— Affected 9.7.0 to before 9.14.2 Fixed in 9.14.2 Patch available GHSA-hjwq-mjwj-4x6c
  • vue-i18n (npm) Vendor— Affected 9.7.0 to before 9.14.2 Fixed in 9.14.2 Patch available GHSA-hjwq-mjwj-4x6c
  • petite-vue-i18n (npm) Vendor— Affected 10.0.0 to before 10.0.5 Fixed in 10.0.5 Patch available GHSA-hjwq-mjwj-4x6c
  • @intlify/shared (npm) Vendor— Affected 10.0.0 to before 10.0.5 Fixed in 10.0.5 Patch available GHSA-hjwq-mjwj-4x6c
  • @intlify/vue-i18n-core (npm) Vendor— Affected 10.0.0 to before 10.0.5 Fixed in 10.0.5 Patch available GHSA-hjwq-mjwj-4x6c
  • vue-i18n (npm) Vendor— Affected 10.0.0 to before 10.0.5 Fixed in 10.0.5 Patch available GHSA-hjwq-mjwj-4x6c

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:intlify:vue-i18n:*:*:*:*:*:*:*:*——intlify
  • cpe:2.3:a:intlify:vue-i18n:*:*:*:*:*:*:*:* Versions — — ·intlify

Remediation

  • Fix · CNA vue-i18n (intlify) Fixed in 9.14.2, 10.0.5
  • Fix · GHSA-hjwq-mjwj-4x6c @intlify/shared (npm) Fixed in 9.14.2 Advisory →
  • Fix · GHSA-hjwq-mjwj-4x6c @intlify/vue-i18n-core (npm) Fixed in 9.14.2 Advisory →
  • Fix · GHSA-hjwq-mjwj-4x6c vue-i18n (npm) Fixed in 9.14.2 Advisory →
  • Fix · GHSA-hjwq-mjwj-4x6c petite-vue-i18n (npm) Fixed in 10.0.5 Advisory →
  • Fix · GHSA-hjwq-mjwj-4x6c @intlify/shared (npm) Fixed in 10.0.5 Advisory →
  • Fix · GHSA-hjwq-mjwj-4x6c @intlify/vue-i18n-core (npm) Fixed in 10.0.5 Advisory →
  • Fix · GHSA-hjwq-mjwj-4x6c vue-i18n (npm) Fixed in 10.0.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-52810
  2. 2026-10-03 Alias added: GHSA-hjwq-mjwj-4x6c

References

Advisory 1

Other 3

  • TI-2025-20407 Vue I18n Prototype Pollution in `handleFlatJson` CVSS 4.0HIGH 8.9
  • TI-2025-33767 Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror CVSS 4.0MEDIUM 5.3
  • TI-2024-35321 Cross-site Scripting vulnerability with prototype pollution in vue-i18n CVSS 4.0MEDIUM 5.3
  • TI-2026-82143 Vue I18n escapeParameter misses named values when a list is passed CVSS 4.0LOW 2.1
  • TI-2026-82144 Cross-site scripting in Vue I18n translations through iframe srcdoc CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences