GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-53892 (GCVE-0-2025-53892)

Vulnerability from cvelistv5 – Published: 2025-07-16 13:42 – Updated: 2025-07-22 14:58
VLAI
Title
Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror
Summary
Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as <img src=x onerror=...>, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-22 14:58 UTC
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version CPE status
intlify vue-i18n Affected: >= 9.0.0, < 9.14.5
Affected: >= 10.0.0, < 10.0.8
Affected: >= 11.0.0, < 11.1.0
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-53892",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-22T14:58:31.075680Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-22T14:58:34.382Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vue-i18n",
          "vendor": "intlify",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.14.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 10.0.0, \u003c 10.0.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 11.0.0, \u003c 11.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as \u003cimg src=x onerror=...\u003e, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-16T13:42:09.383Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph"
        },
        {
          "name": "https://github.com/intlify/vue-i18n/pull/2229",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/intlify/vue-i18n/pull/2229"
        },
        {
          "name": "https://github.com/intlify/vue-i18n/pull/2230",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/intlify/vue-i18n/pull/2230"
        },
        {
          "name": "https://github.com/intlify/vue-i18n/commit/49f982443ab8fd94ecc427b265ce97d57df94d7e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/intlify/vue-i18n/commit/49f982443ab8fd94ecc427b265ce97d57df94d7e"
        },
        {
          "name": "https://github.com/intlify/vue-i18n/commit/a47099619fb9b256e86341a8658ebe72e92ab099",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/intlify/vue-i18n/commit/a47099619fb9b256e86341a8658ebe72e92ab099"
        },
        {
          "name": "https://github.com/intlify/vue-i18n/releases/tag/v10.0.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/intlify/vue-i18n/releases/tag/v10.0.8"
        },
        {
          "name": "https://github.com/intlify/vue-i18n/releases/tag/v11.1.10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/intlify/vue-i18n/releases/tag/v11.1.10"
        },
        {
          "name": "https://github.com/intlify/vue-i18n/releases/tag/v9.14.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/intlify/vue-i18n/releases/tag/v9.14.5"
        }
      ],
      "source": {
        "advisory": "GHSA-x8qp-wqqm-57ph",
        "discovery": "UNKNOWN"
      },
      "title": "Intlify Vue I18n\u0027s escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-53892",
    "datePublished": "2025-07-16T13:42:09.383Z",
    "dateReserved": "2025-07-11T19:05:23.825Z",
    "dateUpdated": "2025-07-22T14:58:34.382Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-53892",
      "date": "2026-09-20",
      "epss": "0.00703",
      "percentile": "0.51827"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "vue-i18n",
                "vendor": "intlify",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 9.0.0, \u003c 9.14.5"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 10.0.0, \u003c 10.0.8"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 11.0.0, \u003c 11.1.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as \u003cimg src=x onerror=...\u003e, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue."
          },
          {
            "lang": "es",
            "value": "Vue I18n es el complemento de internacionalizaci\u00f3n para Vue.js. La opci\u00f3n \"escapeParameterHtml: true\" de Vue I18n est\u00e1 dise\u00f1ada para proteger contra la inyecci\u00f3n de HTML/scripts mediante el escape de par\u00e1metros interpolados. Sin embargo, a partir de la versi\u00f3n 9.0.0 y anteriores a las versiones 9.14.5, 10.0.8 y 11.1.0, esta configuraci\u00f3n no impide la ejecuci\u00f3n de ciertos payloads basadas en etiquetas, como , si el valor interpolado se inserta dentro de un contexto HTML mediante v-html. Esto puede provocar una vulnerabilidad XSS basada en DOM, incluso al usar \"escapeParameterHtml: true\", si una cadena de traducci\u00f3n incluye HTML menor y se renderiza mediante v-html. Las versiones 9.14.5, 10.0.8 y 11.1.0 incluyen una soluci\u00f3n para este problema."
          }
        ],
        "id": "CVE-2025-53892",
        "lastModified": "2026-06-17T09:39:05.340",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-53892",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-22T14:58:31.075680Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-07-16T14:15:28.357",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/intlify/vue-i18n/commit/49f982443ab8fd94ecc427b265ce97d57df94d7e"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/intlify/vue-i18n/commit/a47099619fb9b256e86341a8658ebe72e92ab099"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/intlify/vue-i18n/pull/2229"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/intlify/vue-i18n/pull/2230"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/intlify/vue-i18n/releases/tag/v10.0.8"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/intlify/vue-i18n/releases/tag/v11.1.10"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/intlify/vue-i18n/releases/tag/v9.14.5"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-07-18T13:58:56+00:00",
      "cve": "CVE-2025-53892",
      "id": "CVE-2025-53892",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Intlify Vue I18n\u0027s escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-53892.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-53892",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-07-22T14:58:31.075680Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-07-22T14:57:58.777Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "vue-i18n",
              "vendor": "intlify",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 9.0.0, \u003c 9.14.5"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 10.0.0, \u003c 10.0.8"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 11.0.0, \u003c 11.1.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as \u003cimg src=x onerror=...\u003e, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "PASSIVE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-07-16T13:42:09.383Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph"
            },
            {
              "name": "https://github.com/intlify/vue-i18n/pull/2229",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/intlify/vue-i18n/pull/2229"
            },
            {
              "name": "https://github.com/intlify/vue-i18n/pull/2230",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/intlify/vue-i18n/pull/2230"
            },
            {
              "name": "https://github.com/intlify/vue-i18n/commit/49f982443ab8fd94ecc427b265ce97d57df94d7e",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/intlify/vue-i18n/commit/49f982443ab8fd94ecc427b265ce97d57df94d7e"
            },
            {
              "name": "https://github.com/intlify/vue-i18n/commit/a47099619fb9b256e86341a8658ebe72e92ab099",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/intlify/vue-i18n/commit/a47099619fb9b256e86341a8658ebe72e92ab099"
            },
            {
              "name": "https://github.com/intlify/vue-i18n/releases/tag/v10.0.8",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/intlify/vue-i18n/releases/tag/v10.0.8"
            },
            {
              "name": "https://github.com/intlify/vue-i18n/releases/tag/v11.1.10",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/intlify/vue-i18n/releases/tag/v11.1.10"
            },
            {
              "name": "https://github.com/intlify/vue-i18n/releases/tag/v9.14.5",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/intlify/vue-i18n/releases/tag/v9.14.5"
            }
          ],
          "source": {
            "advisory": "GHSA-x8qp-wqqm-57ph",
            "discovery": "UNKNOWN"
          },
          "title": "Intlify Vue I18n\u0027s escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-53892",
        "datePublished": "2025-07-16T13:42:09.383Z",
        "dateReserved": "2025-07-11T19:05:23.825Z",
        "dateUpdated": "2025-07-22T14:58:34.382Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.