Vulnerability-Lookup

GHSA-83RM-6C8R-G728

Vulnerability from github – Published: 2026-10-28 21:06 – Updated: 2026-10-28 21:06

Summary

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Details

Summary

When escapeParameter is enabled (escapeParameterHtml in the Legacy API), Vue I18n passes the translated string through sanitizeTranslatedHtml(). The sanitizer escapes < and > in attribute values and neutralizes event handler attributes such as onerror, but it does not handle the srcdoc attribute of <iframe>.

The value of srcdoc is an HTML document: the browser decodes the character references in it and parses the result as a nested document in the same origin. The escaping and the neutralization done by the sanitizer are both character references, so they are undone inside srcdoc. This bypasses the fix for CVE-2025-53892 (GHSA-x8qp-wqqm-57ph).

Details

sanitizeTranslatedHtml() (packages/shared/src/sanitize.ts in v11.4.13) works on the final translated string:

It escapes <, >, " and ' inside quoted attribute values.
It rewrites the on of event handler attributes to on.
It replaces javascript: URLs in href, src, action and formaction with about:blank.

Inside srcdoc, steps 1 and 2 only produce character references, which the browser decodes before parsing the value as a document. Markup inside srcdoc therefore survives the sanitizer, with escaping or without it.

This can be reached in three ways:

A parameter inside srcdoc. With a message such as <iframe srcdoc="{content}"></iframe>, escapeParameter escapes content into character references, and the browser decodes them again.
Markup in a message. A message that contains an <iframe srcdoc="..."> keeps it after sanitizing. The documentation asks not to use HTML messages with content from users, but it also says that the sanitizer neutralizes event handlers in the final HTML.
Together with GHSA-8rc2-428q-7ww3. When a call passes a list and named values, the named values are not escaped. An <iframe srcdoc="..."> in a named value then reaches the sanitizer as markup, even with an ordinary message such as {0} {name}.

PoC

import { createI18n } from 'vue-i18n'

const i18n = createI18n({
  legacy: false,
  locale: 'en',
  escapeParameter: true,
  messages: {
    en: { message: '<iframe srcdoc="<b>x</b>"></iframe>' }
  }
})

console.log(i18n.global.t('message'))
// v11.4.13: <iframe srcdoc="&lt;b&gt;x&lt;/b&gt;"></iframe>

The browser decodes the value and renders <b>x</b> as a separate document inside the <iframe>, in the same origin as the page. Any markup in that position is parsed the same way.

Impact

Applications are affected when they enable escapeParameter, render translations as HTML (for example with v-html), and one of the following applies:

an untrusted value is passed as a parameter that the message places inside srcdoc,
message content is not fully trusted (for example crowdsourced or stored translations), or
untrusted named values are passed in the same call as a list (GHSA-8rc2-428q-7ww3).

An attacker can then run script in the origin of the application (DOM-based XSS), despite the sanitizer.

Rendering through <i18n-t> is not affected, since it does not render translations as HTML.

Patches

Fixed in 11.4.14 and 12.0.0-alpha.5. The sanitizer now neutralizes the srcdoc attribute itself, in the same way as event handler attributes.

v9 and v10 are no longer supported and will not be fixed. Please migrate to v11.

Workarounds

Do not render translations that can contain untrusted content with v-html. Use component interpolation (<i18n-t>) instead.
Do not put srcdoc in translation messages, and do not pass values into it.

References

CWE-79, CWE-116
GHSA-x8qp-wqqm-57ph (CVE-2025-53892): the fix that added sanitizeTranslatedHtml()
GHSA-8rc2-428q-7ww3: named values are not escaped when a list is also passed
HTML Standard: the srcdoc attribute

Severity

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "vue-i18n"
      },
      "versions": [
        "9.14.5"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vue-i18n"
      },
      "versions": [
        "10.0.8"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vue-i18n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.1.10"
            },
            {
              "fixed": "11.4.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vue-i18n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.0.0-alpha.4"
            },
            {
              "fixed": "12.0.0-alpha.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.0.0-alpha.4"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "petite-vue-i18n"
      },
      "versions": [
        "9.14.5"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "petite-vue-i18n"
      },
      "versions": [
        "10.0.8"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "petite-vue-i18n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.1.10"
            },
            {
              "fixed": "11.4.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "petite-vue-i18n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.0.0-alpha.4"
            },
            {
              "fixed": "12.0.0-alpha.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.0.0-alpha.4"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/core-base"
      },
      "versions": [
        "9.14.5"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/core-base"
      },
      "versions": [
        "10.0.8"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/core-base"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.1.10"
            },
            {
              "fixed": "11.4.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/core-base"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.0.0-alpha.4"
            },
            {
              "fixed": "12.0.0-alpha.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.0.0-alpha.4"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/core"
      },
      "versions": [
        "9.14.5"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/core"
      },
      "versions": [
        "10.0.8"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.1.10"
            },
            {
              "fixed": "11.4.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.0.0-alpha.4"
            },
            {
              "fixed": "12.0.0-alpha.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.0.0-alpha.4"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/vue-i18n-core"
      },
      "versions": [
        "9.14.5"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/vue-i18n-core"
      },
      "versions": [
        "10.0.8"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/vue-i18n-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.1.10"
            },
            {
              "fixed": "11.4.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/vue-i18n-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.0.0-alpha.4"
            },
            {
              "fixed": "12.0.0-alpha.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.0.0-alpha.4"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/shared"
      },
      "versions": [
        "9.14.5"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/shared"
      },
      "versions": [
        "10.0.8"
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/shared"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.1.10"
            },
            {
              "fixed": "11.4.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/shared"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.0.0-alpha.4"
            },
            {
              "fixed": "12.0.0-alpha.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.0.0-alpha.4"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-118257"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-28T21:06:24Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nWhen `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n passes the translated string through `sanitizeTranslatedHtml()`. The sanitizer escapes `\u003c` and `\u003e` in attribute values and neutralizes event handler attributes such as `onerror`, but it does not handle the `srcdoc` attribute of `\u003ciframe\u003e`.\n\nThe value of `srcdoc` is an HTML document: the browser decodes the character references in it and parses the result as a nested document in the same origin. The escaping and the neutralization done by the sanitizer are both character references, so they are undone inside `srcdoc`. This bypasses the fix for CVE-2025-53892 (GHSA-x8qp-wqqm-57ph).\n\n### Details\n\n`sanitizeTranslatedHtml()` ([`packages/shared/src/sanitize.ts` in v11.4.13](https://github.com/intlify/vue-i18n/blob/v11.4.13/packages/shared/src/sanitize.ts#L126-L162)) works on the final translated string:\n\n1. It escapes `\u003c`, `\u003e`, `\"` and `\u0027` inside quoted attribute values.\n2. It rewrites the `on` of event handler attributes to `\u0026#111;n`.\n3. It replaces `javascript:` URLs in `href`, `src`, `action` and `formaction` with `about:blank`.\n\nInside `srcdoc`, steps 1 and 2 only produce character references, which the browser decodes before parsing the value as a document. Markup inside `srcdoc` therefore survives the sanitizer, with escaping or without it.\n\nThis can be reached in three ways:\n\n- **A parameter inside `srcdoc`.** With a message such as `\u003ciframe srcdoc=\"{content}\"\u003e\u003c/iframe\u003e`, `escapeParameter` escapes `content` into character references, and the browser decodes them again.\n- **Markup in a message.** A message that contains an `\u003ciframe srcdoc=\"...\"\u003e` keeps it after sanitizing. The documentation asks not to use HTML messages with content from users, but it also says that the sanitizer neutralizes event handlers in the final HTML.\n- **Together with GHSA-8rc2-428q-7ww3.** When a call passes a list and named values, the named values are not escaped. An `\u003ciframe srcdoc=\"...\"\u003e` in a named value then reaches the sanitizer as markup, even with an ordinary message such as `{0} {name}`.\n\n### PoC\n\n```js\nimport { createI18n } from \u0027vue-i18n\u0027\n\nconst i18n = createI18n({\n  legacy: false,\n  locale: \u0027en\u0027,\n  escapeParameter: true,\n  messages: {\n    en: { message: \u0027\u003ciframe srcdoc=\"\u003cb\u003ex\u003c/b\u003e\"\u003e\u003c/iframe\u003e\u0027 }\n  }\n})\n\nconsole.log(i18n.global.t(\u0027message\u0027))\n// v11.4.13: \u003ciframe srcdoc=\"\u0026lt;b\u0026gt;x\u0026lt;/b\u0026gt;\"\u003e\u003c/iframe\u003e\n```\n\nThe browser decodes the value and renders `\u003cb\u003ex\u003c/b\u003e` as a separate document inside the `\u003ciframe\u003e`, in the same origin as the page. Any markup in that position is parsed the same way.\n\n### Impact\n\nApplications are affected when they enable `escapeParameter`, render translations as HTML (for example with `v-html`), and one of the following applies:\n\n- an untrusted value is passed as a parameter that the message places inside `srcdoc`,\n- message content is not fully trusted (for example crowdsourced or stored translations), or\n- untrusted named values are passed in the same call as a list (GHSA-8rc2-428q-7ww3).\n\nAn attacker can then run script in the origin of the application (DOM-based XSS), despite the sanitizer.\n\nRendering through `\u003ci18n-t\u003e` is not affected, since it does not render translations as HTML.\n\n### Patches\n\nFixed in 11.4.14 and 12.0.0-alpha.5. The sanitizer now neutralizes the `srcdoc` attribute itself, in the same way as event handler attributes.\n\nv9 and v10 are no longer supported and will not be fixed. Please migrate to v11.\n\n### Workarounds\n\n- Do not render translations that can contain untrusted content with `v-html`. Use component interpolation (`\u003ci18n-t\u003e`) instead.\n- Do not put `srcdoc` in translation messages, and do not pass values into it.\n\n### References\n\n- [CWE-79](https://cwe.mitre.org/data/definitions/79.html), [CWE-116](https://cwe.mitre.org/data/definitions/116.html)\n- [GHSA-x8qp-wqqm-57ph](https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph) (CVE-2025-53892): the fix that added `sanitizeTranslatedHtml()`\n- [GHSA-8rc2-428q-7ww3](https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3): named values are not escaped when a list is also passed\n- [HTML Standard: the `srcdoc` attribute](https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-srcdoc)",
  "id": "GHSA-83rm-6c8r-g728",
  "modified": "2026-10-28T21:06:24Z",
  "published": "2026-10-28T21:06:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-83rm-6c8r-g728"
    },
    {
      "type": "WEB",
      "url": "https://github.com/intlify/vue-i18n/pull/2679"
    },
    {
      "type": "WEB",
      "url": "https://github.com/intlify/vue-i18n/commit/43391d20e7c85403cb59bdb21b5d542819f54042"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/intlify/vue-i18n"
    },
    {
      "type": "WEB",
      "url": "https://github.com/intlify/vue-i18n/releases/tag/v11.4.14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages"
}

CVE-2026-118257 (GCVE-0-2026-118257)

Vulnerability from cvelistv5 – Published: 2026-10-28 18:23 – Updated: 2026-10-29 20:55

Title

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Summary

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 15:43 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-116 - Improper Encoding or Escaping of Output

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8129 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/intlify/vue-i18n/security/advi…	x_refsource_CONFIRM
https://github.com/intlify/vue-i18n/pull/2679	x_refsource_MISC
https://github.com/intlify/vue-i18n/commit/43391d…	x_refsource_MISC
https://github.com/intlify/vue-i18n/releases/tag/…	x_refsource_MISC
https://github.com/intlify/vue-i18n/releases/tag/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
intlify	vue-i18n	Affected: = 9.14.5 Affected: = 10.0.8 Affected: >= 11.1.10, < 11.4.14 Affected: >= 12.0.0-alpha.4, < 12.0.0-alpha.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118257",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T15:43:29.896851Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T20:55:05.780Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vue-i18n",
          "vendor": "intlify",
          "versions": [
            {
              "status": "affected",
              "version": "= 9.14.5"
            },
            {
              "status": "affected",
              "version": "= 10.0.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 11.1.10, \u003c 11.4.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 12.0.0-alpha.4, \u003c 12.0.0-alpha.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T18:23:49.400Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-83rm-6c8r-g728",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-83rm-6c8r-g728"
        },
        {
          "name": "https://github.com/intlify/vue-i18n/pull/2679",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/intlify/vue-i18n/pull/2679"
        },
        {
          "name": "https://github.com/intlify/vue-i18n/commit/43391d20e7c85403cb59bdb21b5d542819f54042",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/intlify/vue-i18n/commit/43391d20e7c85403cb59bdb21b5d542819f54042"
        },
        {
          "name": "https://github.com/intlify/vue-i18n/releases/tag/v11.4.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/intlify/vue-i18n/releases/tag/v11.4.14"
        },
        {
          "name": "https://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5"
        }
      ],
      "source": {
        "advisory": "GHSA-83rm-6c8r-g728",
        "discovery": "UNKNOWN"
      },
      "title": "Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-118257",
    "datePublished": "2026-10-28T18:23:49.400Z",
    "dateReserved": "2026-10-27T20:13:55.314Z",
    "dateUpdated": "2026-10-29T20:55:05.780Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-83RM-6C8R-G728

Summary

Details

PoC

Impact

Patches

Workarounds

References

CVE-2026-118257 (GCVE-0-2026-118257)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour