Read the docs
TI-2026-82144 Aliases CVE-2026-118257GHSA-83rm-6c8r-g728

Cross-site scripting in Vue I18n translations through iframe srcdoc

Priority LOW 37CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Vue I18n, the internationalization plugin for Vue.js, is affected from 11.1.10 before 11.4.14, from 12.0.0-alpha.4 before 12.0.0-alpha.5, and at 9.14.5 and 10.0.8. The sanitizeTranslatedHtml() function escapes text in an iframe srcdoc value but leaves the srcdoc attribute active, so the browser decodes the value and parses it as a same-origin nested document that runs script (CWE-79). An attacker who controls parameters or translation content can run script when escapeParameter is enabled and v-html renders translations.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00272 19th percentileScored 2026-11-07
Fix Fixed vue-i18n (intlify): 11.4.14, 12.0.0-alpha.5vue-i18n (npm): 11.4.14, 12.0.0-alpha.5+5 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
intlifyvue-i18n= 9.14.5; = 10.0.8; 11.1.10 to before 11.4.14; 12.0.0-alpha.4 to before 12.0.0-alpha.511.4.14, 12.0.0-alpha.5Patch availableCNA
—vue-i18n (npm)——No fix listedGHSA-83rm-6c8r-g728
—vue-i18n (npm)——No fix listedGHSA-83rm-6c8r-g728
—vue-i18n (npm)11.1.10 to before 11.4.1411.4.14Patch availableGHSA-83rm-6c8r-g728
—vue-i18n (npm)12.0.0-alpha.4 to before 12.0.0-alpha.512.0.0-alpha.5Patch availableGHSA-83rm-6c8r-g728
—petite-vue-i18n (npm)——No fix listedGHSA-83rm-6c8r-g728
—petite-vue-i18n (npm)——No fix listedGHSA-83rm-6c8r-g728
—petite-vue-i18n (npm)11.1.10 to before 11.4.1411.4.14Patch availableGHSA-83rm-6c8r-g728
—petite-vue-i18n (npm)12.0.0-alpha.4 to before 12.0.0-alpha.512.0.0-alpha.5Patch availableGHSA-83rm-6c8r-g728
—@intlify/core-base (npm)——No fix listedGHSA-83rm-6c8r-g728
—@intlify/core-base (npm)——No fix listedGHSA-83rm-6c8r-g728
—@intlify/core-base (npm)11.1.10 to before 11.4.1411.4.14Patch availableGHSA-83rm-6c8r-g728
—@intlify/core-base (npm)12.0.0-alpha.4 to before 12.0.0-alpha.512.0.0-alpha.5Patch availableGHSA-83rm-6c8r-g728
—@intlify/core (npm)——No fix listedGHSA-83rm-6c8r-g728
—@intlify/core (npm)——No fix listedGHSA-83rm-6c8r-g728
—@intlify/core (npm)11.1.10 to before 11.4.1411.4.14Patch availableGHSA-83rm-6c8r-g728
—@intlify/core (npm)12.0.0-alpha.4 to before 12.0.0-alpha.512.0.0-alpha.5Patch availableGHSA-83rm-6c8r-g728
—@intlify/vue-i18n-core (npm)——No fix listedGHSA-83rm-6c8r-g728
—@intlify/vue-i18n-core (npm)——No fix listedGHSA-83rm-6c8r-g728
—@intlify/vue-i18n-core (npm)11.1.10 to before 11.4.1411.4.14Patch availableGHSA-83rm-6c8r-g728
—@intlify/vue-i18n-core (npm)12.0.0-alpha.4 to before 12.0.0-alpha.512.0.0-alpha.5Patch availableGHSA-83rm-6c8r-g728
—@intlify/shared (npm)——No fix listedGHSA-83rm-6c8r-g728
—@intlify/shared (npm)——No fix listedGHSA-83rm-6c8r-g728
—@intlify/shared (npm)11.1.10 to before 11.4.1411.4.14Patch availableGHSA-83rm-6c8r-g728
—@intlify/shared (npm)12.0.0-alpha.4 to before 12.0.0-alpha.512.0.0-alpha.5Patch availableGHSA-83rm-6c8r-g728
  • vue-i18n Vendorintlify Affected = 9.14.5; = 10.0.8; 11.1.10 to before 11.4.14; 12.0.0-alpha.4 to before 12.0.0-alpha.5 Fixed in 11.4.14, 12.0.0-alpha.5 Patch available CNA
  • vue-i18n (npm) Vendor— Affected — Fixed in — No fix listed GHSA-83rm-6c8r-g728
  • vue-i18n (npm) Vendor— Affected — Fixed in — No fix listed GHSA-83rm-6c8r-g728
  • vue-i18n (npm) Vendor— Affected 11.1.10 to before 11.4.14 Fixed in 11.4.14 Patch available GHSA-83rm-6c8r-g728
  • vue-i18n (npm) Vendor— Affected 12.0.0-alpha.4 to before 12.0.0-alpha.5 Fixed in 12.0.0-alpha.5 Patch available GHSA-83rm-6c8r-g728
  • petite-vue-i18n (npm) Vendor— Affected — Fixed in — No fix listed GHSA-83rm-6c8r-g728
  • petite-vue-i18n (npm) Vendor— Affected — Fixed in — No fix listed GHSA-83rm-6c8r-g728
  • petite-vue-i18n (npm) Vendor— Affected 11.1.10 to before 11.4.14 Fixed in 11.4.14 Patch available GHSA-83rm-6c8r-g728
  • petite-vue-i18n (npm) Vendor— Affected 12.0.0-alpha.4 to before 12.0.0-alpha.5 Fixed in 12.0.0-alpha.5 Patch available GHSA-83rm-6c8r-g728
  • @intlify/core-base (npm) Vendor— Affected — Fixed in — No fix listed GHSA-83rm-6c8r-g728
  • @intlify/core-base (npm) Vendor— Affected — Fixed in — No fix listed GHSA-83rm-6c8r-g728
  • @intlify/core-base (npm) Vendor— Affected 11.1.10 to before 11.4.14 Fixed in 11.4.14 Patch available GHSA-83rm-6c8r-g728
  • @intlify/core-base (npm) Vendor— Affected 12.0.0-alpha.4 to before 12.0.0-alpha.5 Fixed in 12.0.0-alpha.5 Patch available GHSA-83rm-6c8r-g728
  • @intlify/core (npm) Vendor— Affected — Fixed in — No fix listed GHSA-83rm-6c8r-g728
  • @intlify/core (npm) Vendor— Affected — Fixed in — No fix listed GHSA-83rm-6c8r-g728
  • @intlify/core (npm) Vendor— Affected 11.1.10 to before 11.4.14 Fixed in 11.4.14 Patch available GHSA-83rm-6c8r-g728
  • @intlify/core (npm) Vendor— Affected 12.0.0-alpha.4 to before 12.0.0-alpha.5 Fixed in 12.0.0-alpha.5 Patch available GHSA-83rm-6c8r-g728
  • @intlify/vue-i18n-core (npm) Vendor— Affected — Fixed in — No fix listed GHSA-83rm-6c8r-g728
  • @intlify/vue-i18n-core (npm) Vendor— Affected — Fixed in — No fix listed GHSA-83rm-6c8r-g728
  • @intlify/vue-i18n-core (npm) Vendor— Affected 11.1.10 to before 11.4.14 Fixed in 11.4.14 Patch available GHSA-83rm-6c8r-g728
  • @intlify/vue-i18n-core (npm) Vendor— Affected 12.0.0-alpha.4 to before 12.0.0-alpha.5 Fixed in 12.0.0-alpha.5 Patch available GHSA-83rm-6c8r-g728
  • @intlify/shared (npm) Vendor— Affected — Fixed in — No fix listed GHSA-83rm-6c8r-g728
  • @intlify/shared (npm) Vendor— Affected — Fixed in — No fix listed GHSA-83rm-6c8r-g728
  • @intlify/shared (npm) Vendor— Affected 11.1.10 to before 11.4.14 Fixed in 11.4.14 Patch available GHSA-83rm-6c8r-g728
  • @intlify/shared (npm) Vendor— Affected 12.0.0-alpha.4 to before 12.0.0-alpha.5 Fixed in 12.0.0-alpha.5 Patch available GHSA-83rm-6c8r-g728

Remediation

Upgrade vue-i18n, petite-vue-i18n and @intlify/core-base to 11.4.14 or 12.0.0-alpha.5. Versions 9.14.5 and 10.0.8 are no longer supported and have no fix, so move off them.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA vue-i18n (intlify) Fixed in 11.4.14, 12.0.0-alpha.5
  • Fix · GHSA-83rm-6c8r-g728 vue-i18n (npm) Fixed in 11.4.14 Advisory →
  • Fix · GHSA-83rm-6c8r-g728 vue-i18n (npm) Fixed in 12.0.0-alpha.5 Advisory →
  • Fix · GHSA-83rm-6c8r-g728 petite-vue-i18n (npm) Fixed in 11.4.14 Advisory →
  • Fix · GHSA-83rm-6c8r-g728 petite-vue-i18n (npm) Fixed in 12.0.0-alpha.5 Advisory →
  • Fix · GHSA-83rm-6c8r-g728 @intlify/core-base (npm) Fixed in 11.4.14 Advisory →
  • Fix · GHSA-83rm-6c8r-g728 @intlify/core-base (npm) Fixed in 12.0.0-alpha.5 Advisory →
  • Fix · GHSA-83rm-6c8r-g728 @intlify/core (npm) Fixed in 11.4.14 Advisory →
  • Fix · GHSA-83rm-6c8r-g728 @intlify/core (npm) Fixed in 12.0.0-alpha.5 Advisory →
  • Fix · GHSA-83rm-6c8r-g728 @intlify/vue-i18n-core (npm) Fixed in 11.4.14 Advisory →
  • Fix · GHSA-83rm-6c8r-g728 @intlify/vue-i18n-core (npm) Fixed in 12.0.0-alpha.5 Advisory →
  • Fix · GHSA-83rm-6c8r-g728 @intlify/shared (npm) Fixed in 11.4.14 Advisory →
  • Fix · GHSA-83rm-6c8r-g728 @intlify/shared (npm) Fixed in 12.0.0-alpha.5 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • OpenShift API for Data Protection

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118257
  2. 2026-10-28 Alias added: GHSA-83rm-6c8r-g728
  3. 2026-10-28 Fix available: npm/@intlify/[email protected], npm/@intlify/[email protected], npm/@intlify/[email protected] +9 · GHSA-83rm-6c8r-g728
  4. 2026-10-28 CVSS score added · GHSA-83rm-6c8r-g728
  5. 2026-10-28 Weakness changed · GHSA-83rm-6c8r-g728
  6. 2026-10-28 6 new references · GHSA-83rm-6c8r-g728
  7. 2026-10-29 CISA SSVC decision points changed
  8. 2026-10-29 Priority changed: MEDIUM → LOW
  9. 2026-10-30 Affected versions changed · Red Hat
  10. 2026-10-30 CVSS score added · Red Hat

References

Other 6

  • TI-2025-20407 Vue I18n Prototype Pollution in `handleFlatJson` CVSS 4.0HIGH 8.9
  • TI-2024-35322 Prototype Pollution in @intlify/shared >=9.7.0 <= 10.0.4 CVSS 4.0MEDIUM 6.9
  • TI-2025-33767 Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror CVSS 4.0MEDIUM 5.3
  • TI-2024-35321 Cross-site Scripting vulnerability with prototype pollution in vue-i18n CVSS 4.0MEDIUM 5.3
  • TI-2026-82143 Vue I18n escapeParameter misses named values when a list is passed CVSS 4.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences