Read the docs
TI-2026-82143 Aliases CVE-2026-118256GHSA-8rc2-428q-7ww3

Vue I18n escapeParameter misses named values when a list is passed

Priority MEDIUM 44CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

The vue-i18n npm package from 9.0.0-beta.5 before 11.4.14 and from 12.0.0-alpha.1 before 12.0.0-alpha.5 does not escape named interpolation values when escapeParameter is enabled and the same translation call also passes a list, because escapeParams() processes only the list branch. An attacker who controls named values in an application that renders translations as HTML can insert markup such as phishing links, forms or layout changes, and can run script when combined with the srcdoc sanitizer bypass or on releases without the sanitizer (CWE-79).

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0048 41st percentileScored 2026-11-07
Fix Fixed vue-i18n (intlify): 11.4.14, 12.0.0-alpha.5vue-i18n (npm): 11.4.14, 12.0.0-alpha.5+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
intlifyvue-i18n9.0.0-beta.5 to before 11.4.14; 12.0.0-alpha.1 to before 12.0.0-alpha.511.4.14, 12.0.0-alpha.5Patch availableCNA
—vue-i18n (npm)9.0.0-beta.5 to before 11.4.1411.4.14Patch availableGHSA-8rc2-428q-7ww3
—vue-i18n (npm)12.0.0-alpha.1 to before 12.0.0-alpha.512.0.0-alpha.5Patch availableGHSA-8rc2-428q-7ww3
—@intlify/core (npm)9.0.0-beta.10 to before 11.4.1411.4.14Patch availableGHSA-8rc2-428q-7ww3
—@intlify/core (npm)12.0.0-alpha.1 to before 12.0.0-alpha.512.0.0-alpha.5Patch availableGHSA-8rc2-428q-7ww3
—@intlify/core-base (npm)9.0.0-beta.12 to before 11.4.1411.4.14Patch availableGHSA-8rc2-428q-7ww3
—@intlify/core-base (npm)12.0.0-alpha.1 to before 12.0.0-alpha.512.0.0-alpha.5Patch availableGHSA-8rc2-428q-7ww3
—petite-vue-i18n (npm)9.2.0-alpha.7 to before 11.4.1411.4.14Patch availableGHSA-8rc2-428q-7ww3
—petite-vue-i18n (npm)12.0.0-alpha.1 to before 12.0.0-alpha.512.0.0-alpha.5Patch availableGHSA-8rc2-428q-7ww3
—@intlify/vue-i18n-core (npm)9.2.0-alpha.7 to before 11.4.1411.4.14Patch availableGHSA-8rc2-428q-7ww3
—@intlify/vue-i18n-core (npm)12.0.0-alpha.1 to before 12.0.0-alpha.512.0.0-alpha.5Patch availableGHSA-8rc2-428q-7ww3
  • vue-i18n Vendorintlify Affected 9.0.0-beta.5 to before 11.4.14; 12.0.0-alpha.1 to before 12.0.0-alpha.5 Fixed in 11.4.14, 12.0.0-alpha.5 Patch available CNA
  • vue-i18n (npm) Vendor— Affected 9.0.0-beta.5 to before 11.4.14 Fixed in 11.4.14 Patch available GHSA-8rc2-428q-7ww3
  • vue-i18n (npm) Vendor— Affected 12.0.0-alpha.1 to before 12.0.0-alpha.5 Fixed in 12.0.0-alpha.5 Patch available GHSA-8rc2-428q-7ww3
  • @intlify/core (npm) Vendor— Affected 9.0.0-beta.10 to before 11.4.14 Fixed in 11.4.14 Patch available GHSA-8rc2-428q-7ww3
  • @intlify/core (npm) Vendor— Affected 12.0.0-alpha.1 to before 12.0.0-alpha.5 Fixed in 12.0.0-alpha.5 Patch available GHSA-8rc2-428q-7ww3
  • @intlify/core-base (npm) Vendor— Affected 9.0.0-beta.12 to before 11.4.14 Fixed in 11.4.14 Patch available GHSA-8rc2-428q-7ww3
  • @intlify/core-base (npm) Vendor— Affected 12.0.0-alpha.1 to before 12.0.0-alpha.5 Fixed in 12.0.0-alpha.5 Patch available GHSA-8rc2-428q-7ww3
  • petite-vue-i18n (npm) Vendor— Affected 9.2.0-alpha.7 to before 11.4.14 Fixed in 11.4.14 Patch available GHSA-8rc2-428q-7ww3
  • petite-vue-i18n (npm) Vendor— Affected 12.0.0-alpha.1 to before 12.0.0-alpha.5 Fixed in 12.0.0-alpha.5 Patch available GHSA-8rc2-428q-7ww3
  • @intlify/vue-i18n-core (npm) Vendor— Affected 9.2.0-alpha.7 to before 11.4.14 Fixed in 11.4.14 Patch available GHSA-8rc2-428q-7ww3
  • @intlify/vue-i18n-core (npm) Vendor— Affected 12.0.0-alpha.1 to before 12.0.0-alpha.5 Fixed in 12.0.0-alpha.5 Patch available GHSA-8rc2-428q-7ww3

Remediation

Upgrade vue-i18n to 11.4.14 or 12.0.0-alpha.5. The fixed versions are 11.4.14 for vue-i18n, @intlify/core, @intlify/core-base, petite-vue-i18n and @intlify/vue-i18n-core, and 12.0.0-alpha.5 for the same packages on the 12 line.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA vue-i18n (intlify) Fixed in 11.4.14, 12.0.0-alpha.5
  • Fix · GHSA-8rc2-428q-7ww3 vue-i18n (npm) Fixed in 11.4.14 Advisory →
  • Fix · GHSA-8rc2-428q-7ww3 vue-i18n (npm) Fixed in 12.0.0-alpha.5 Advisory →
  • Fix · GHSA-8rc2-428q-7ww3 @intlify/core (npm) Fixed in 11.4.14 Advisory →
  • Fix · GHSA-8rc2-428q-7ww3 @intlify/core (npm) Fixed in 12.0.0-alpha.5 Advisory →
  • Fix · GHSA-8rc2-428q-7ww3 @intlify/core-base (npm) Fixed in 11.4.14 Advisory →
  • Fix · GHSA-8rc2-428q-7ww3 @intlify/core-base (npm) Fixed in 12.0.0-alpha.5 Advisory →
  • Fix · GHSA-8rc2-428q-7ww3 petite-vue-i18n (npm) Fixed in 11.4.14 Advisory →
  • Fix · GHSA-8rc2-428q-7ww3 petite-vue-i18n (npm) Fixed in 12.0.0-alpha.5 Advisory →
  • Fix · GHSA-8rc2-428q-7ww3 @intlify/vue-i18n-core (npm) Fixed in 11.4.14 Advisory →
  • Fix · GHSA-8rc2-428q-7ww3 @intlify/vue-i18n-core (npm) Fixed in 12.0.0-alpha.5 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • OpenShift API for Data Protection

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118256
  2. 2026-10-28 Alias added: GHSA-8rc2-428q-7ww3
  3. 2026-10-28 Fix available: npm/@intlify/[email protected], npm/@intlify/[email protected], npm/@intlify/[email protected] +7 · GHSA-8rc2-428q-7ww3
  4. 2026-10-28 CVSS score added · GHSA-8rc2-428q-7ww3
  5. 2026-10-28 Weakness changed · GHSA-8rc2-428q-7ww3
  6. 2026-10-28 6 new references · GHSA-8rc2-428q-7ww3
  7. 2026-10-30 Affected versions changed · Red Hat
  8. 2026-10-30 CVSS score added · Red Hat
  9. 2026-10-30 CISA SSVC decision points changed
  10. 2026-10-30 Priority changed: LOW → MEDIUM

References

Other 6

  • TI-2025-20407 Vue I18n Prototype Pollution in `handleFlatJson` CVSS 4.0HIGH 8.9
  • TI-2024-35322 Prototype Pollution in @intlify/shared >=9.7.0 <= 10.0.4 CVSS 4.0MEDIUM 6.9
  • TI-2025-33767 Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror CVSS 4.0MEDIUM 5.3
  • TI-2024-35321 Cross-site Scripting vulnerability with prototype pollution in vue-i18n CVSS 4.0MEDIUM 5.3
  • TI-2026-82144 Cross-site scripting in Vue I18n translations through iframe srcdoc CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences