https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 31 Oct 2026 03:06:56 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-118257 <p>Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.</p> <p>Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.</p> https://db.gcve.eu/vuln/fkie_cve-2026-118257 https://db.gcve.eu/vuln/ghsa-83rm-6c8r-g728 <p><strong>Affected:</strong> npm: vue-i18n, npm: petite-vue-i18n, npm: @intlify/core-base, npm: @intlify/core, npm: @intlify/vue-i18n-core, npm: @intlify/shared</p> <p>### Summary</p> <p>When `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n passes the translated string through `sanitizeTranslatedHtml()`. The sanitizer escapes `&lt;` and `&gt;` in attribute values and neutralizes event handler attributes such as `onerror`, but it does not handle the `srcdoc` attribute of `&lt;iframe&gt;`.</p> <p>The value of `srcdoc` is an HTML document: the browser decodes the character references in it and parses the result as a nested document in the same origin. The escaping and the neutralization done by the sanitizer are both character references, so they are undone inside `srcdoc`. This bypasses the fix for CVE-2025-53892 (GHSA-x8qp-wqqm-57ph).</p> <p>### Details</p> <p>`sanitizeTranslatedHtml()` ([`packages/shared/src/sanitize.ts` in v11.4.13](https://github.com/intlify/vue-i18n/blob/v11.4.13/packages/shared/src/sanitize.ts#L126-L162)) works on the final translated string:</p> <p>1. It escapes `&lt;`, `&gt;`, `&#34;` and `&#39;` inside quoted attribute values. 2. It rewrites the `on` of event handler attributes to `&amp;#111;n`. 3. It replaces `javascript:` URLs in `href`, `src`, `action` and `formaction` with `about:blank`.</p> <p>Inside `srcdoc`, steps 1 and 2 only produce character references, which the browser decodes before parsing the value as a document. Markup inside `srcdoc` therefore survives the sanitizer, with escaping or without it.</p> <p>This can be reached in three ways:</p> <p>- **A parameter inside `srcdoc`.** With a message such as `&lt;iframe srcdoc=&#34;{content}&#34;&gt;&lt;/iframe&gt;`, `esc…</p> <p><strong>Affected:</strong> npm: vue-i18n, npm: petite-vue-i18n, npm: @intlify/core-base, npm: @intlify/core, npm: @intlify/vue-i18n-core, npm: @intlify/shared</p> <p>### Summary</p> <p>When `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n passes the translated string through `sanitizeTranslatedHtml()`. The sanitizer escapes `&lt;` and `&gt;` in attribute values and neutralizes event handler attributes such as `onerror`, but it does not handle the `srcdoc` attribute of `&lt;iframe&gt;`.</p> <p>The value of `srcdoc` is an HTML document: the browser decodes the character references in it and parses the result as a nested document in the same origin. The escaping and the neutralization done by the sanitizer are both character references, so they are undone inside `srcdoc`. This bypasses the fix for CVE-2025-53892 (GHSA-x8qp-wqqm-57ph).</p> <p>### Details</p> <p>`sanitizeTranslatedHtml()` ([`packages/shared/src/sanitize.ts` in v11.4.13](https://github.com/intlify/vue-i18n/blob/v11.4.13/packages/shared/src/sanitize.ts#L126-L162)) works on the final translated string:</p> <p>1. It escapes `&lt;`, `&gt;`, `&#34;` and `&#39;` inside quoted attribute values. 2. It rewrites the `on` of event handler attributes to `&amp;#111;n`. 3. It replaces `javascript:` URLs in `href`, `src`, `action` and `formaction` with `about:blank`.</p> <p>Inside `srcdoc`, steps 1 and 2 only produce character references, which the browser decodes before parsing the value as a document. Markup inside `srcdoc` therefore survives the sanitizer, with escaping or without it.</p> <p>This can be reached in three ways:</p> <p>- **A parameter inside `srcdoc`.** With a message such as `&lt;iframe srcdoc=&#34;{content}&#34;&gt;&lt;/iframe&gt;`, `esc…</p> https://db.gcve.eu/vuln/ghsa-83rm-6c8r-g728