GHSA-8RC2-428Q-7WW3
Vulnerability from github – Published: 2026-10-28 21:06 – Updated: 2026-10-28 21:06Summary
When escapeParameter is enabled (escapeParameterHtml in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. escapeParams() escapes either the list values or the named values, but not both: the two branches are joined by else. When a single call passes both, for example t(key, ['...'], { named: { ... } }), the named values reach the message without being escaped.
Details
escapeParams() in packages/core-base/src/translate.ts (v11.4.13):
function escapeParams(options: TranslateOptions) {
if (isArray(options.list)) {
options.list = options.list.map(item => (isString(item) ? escapeHtml(item) : item))
} else if (isObject(options.named)) {
// ...escapes the named values
}
}
t(key, list, options) is a public overload, and TranslateOptions has a named field, so a call can carry both. The list is checked first, and the named values are then left as they are.
The translated string still goes through sanitizeTranslatedHtml() (added for CVE-2025-53892), which neutralizes event handler attributes and javascript: URLs. Other markup in the named values, such as links and forms, is inserted as is. Before the fix for GHSA-83rm-6c8r-g728, an <iframe srcdoc> in a named value also passes the sanitizer, and script runs. Versions without the sanitizer (before 9.14.5, 10.0.8 and 11.1.10, and 12.0.0-alpha.1 to alpha.3) insert the named values as HTML without any further check.
<i18n-t> is not affected: it passes either list or named values, never both, and it does not render translations as HTML.
PoC
import { createI18n } from 'vue-i18n'
const i18n = createI18n({
legacy: false,
locale: 'en',
escapeParameter: true,
messages: {
en: { withList: '{0} {name}', withoutList: '{name}' }
}
})
const t = i18n.global.t
t('withoutList', { name: '<b>x</b>' })
// <b>x</b> escaped
t('withList', ['a'], { named: { name: '<b>x</b>' } })
// a <b>x</b> not escaped (v11.4.13)
Impact
Applications are affected when they enable escapeParameter, render translations as HTML (for example with v-html), and pass untrusted named values in the same call as a list. The named values are inserted as markup: phishing links, forms, or layout changes. Together with GHSA-83rm-6c8r-g728, or on versions without the sanitizer, this leads to script execution (DOM-based XSS).
Patches
Fixed in 11.4.14 and 12.0.0-alpha.5. escapeParams() now escapes both the list and the named values.
The fix also stops rewriting the named object that the caller passes. Before, the values of that object were replaced with their escaped form, so a second call with the same object escaped them twice.
v9 and v10 are no longer supported and will not be fixed. Please migrate to v11.
Workarounds
- Do not pass list and named values in the same call when
escapeParameteris enabled. - Do not render translations that can contain untrusted values with
v-html. Use component interpolation (<i18n-t>) instead.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "vue-i18n"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0-beta.5"
},
{
"fixed": "11.4.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "vue-i18n"
},
"ranges": [
{
"events": [
{
"introduced": "12.0.0-alpha.1"
},
{
"fixed": "12.0.0-alpha.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@intlify/core"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0-beta.10"
},
{
"fixed": "11.4.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@intlify/core"
},
"ranges": [
{
"events": [
{
"introduced": "12.0.0-alpha.1"
},
{
"fixed": "12.0.0-alpha.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@intlify/core-base"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0-beta.12"
},
{
"fixed": "11.4.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@intlify/core-base"
},
"ranges": [
{
"events": [
{
"introduced": "12.0.0-alpha.1"
},
{
"fixed": "12.0.0-alpha.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "petite-vue-i18n"
},
"ranges": [
{
"events": [
{
"introduced": "9.2.0-alpha.7"
},
{
"fixed": "11.4.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "petite-vue-i18n"
},
"ranges": [
{
"events": [
{
"introduced": "12.0.0-alpha.1"
},
{
"fixed": "12.0.0-alpha.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@intlify/vue-i18n-core"
},
"ranges": [
{
"events": [
{
"introduced": "9.2.0-alpha.7"
},
{
"fixed": "11.4.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@intlify/vue-i18n-core"
},
"ranges": [
{
"events": [
{
"introduced": "12.0.0-alpha.1"
},
{
"fixed": "12.0.0-alpha.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-118256"
],
"database_specific": {
"cwe_ids": [
"CWE-116",
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-28T21:06:34Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Summary\n\nWhen `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. `escapeParams()` escapes either the list values or the named values, but not both: the two branches are joined by `else`. When a single call passes both, for example `t(key, [\u0027...\u0027], { named: { ... } })`, the named values reach the message without being escaped.\n\n### Details\n\n`escapeParams()` in [`packages/core-base/src/translate.ts` (v11.4.13)](https://github.com/intlify/vue-i18n/blob/v11.4.13/packages/core-base/src/translate.ts):\n\n```ts\nfunction escapeParams(options: TranslateOptions) {\n if (isArray(options.list)) {\n options.list = options.list.map(item =\u003e (isString(item) ? escapeHtml(item) : item))\n } else if (isObject(options.named)) {\n // ...escapes the named values\n }\n}\n```\n\n`t(key, list, options)` is a public overload, and `TranslateOptions` has a `named` field, so a call can carry both. The list is checked first, and the named values are then left as they are.\n\nThe translated string still goes through `sanitizeTranslatedHtml()` (added for CVE-2025-53892), which neutralizes event handler attributes and `javascript:` URLs. Other markup in the named values, such as links and forms, is inserted as is. Before the fix for GHSA-83rm-6c8r-g728, an `\u003ciframe srcdoc\u003e` in a named value also passes the sanitizer, and script runs. Versions without the sanitizer (before 9.14.5, 10.0.8 and 11.1.10, and 12.0.0-alpha.1 to alpha.3) insert the named values as HTML without any further check.\n\n`\u003ci18n-t\u003e` is not affected: it passes either list or named values, never both, and it does not render translations as HTML.\n\n### PoC\n\n```js\nimport { createI18n } from \u0027vue-i18n\u0027\n\nconst i18n = createI18n({\n legacy: false,\n locale: \u0027en\u0027,\n escapeParameter: true,\n messages: {\n en: { withList: \u0027{0} {name}\u0027, withoutList: \u0027{name}\u0027 }\n }\n})\nconst t = i18n.global.t\n\nt(\u0027withoutList\u0027, { name: \u0027\u003cb\u003ex\u003c/b\u003e\u0027 })\n// \u0026lt;b\u0026gt;x\u0026lt;\u0026#x2F;b\u0026gt; escaped\n\nt(\u0027withList\u0027, [\u0027a\u0027], { named: { name: \u0027\u003cb\u003ex\u003c/b\u003e\u0027 } })\n// a \u003cb\u003ex\u003c/b\u003e not escaped (v11.4.13)\n```\n\n### Impact\n\nApplications are affected when they enable `escapeParameter`, render translations as HTML (for example with `v-html`), and pass untrusted named values in the same call as a list. The named values are inserted as markup: phishing links, forms, or layout changes. Together with GHSA-83rm-6c8r-g728, or on versions without the sanitizer, this leads to script execution (DOM-based XSS).\n\n### Patches\n\nFixed in 11.4.14 and 12.0.0-alpha.5. `escapeParams()` now escapes both the list and the named values.\n\nThe fix also stops rewriting the named object that the caller passes. Before, the values of that object were replaced with their escaped form, so a second call with the same object escaped them twice.\n\nv9 and v10 are no longer supported and will not be fixed. Please migrate to v11.\n\n### Workarounds\n\n- Do not pass list and named values in the same call when `escapeParameter` is enabled.\n- Do not render translations that can contain untrusted values with `v-html`. Use component interpolation (`\u003ci18n-t\u003e`) instead.",
"id": "GHSA-8rc2-428q-7ww3",
"modified": "2026-10-28T21:06:34Z",
"published": "2026-10-28T21:06:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3"
},
{
"type": "WEB",
"url": "https://github.com/intlify/vue-i18n/pull/2680"
},
{
"type": "WEB",
"url": "https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8"
},
{
"type": "PACKAGE",
"url": "https://github.com/intlify/vue-i18n"
},
{
"type": "WEB",
"url": "https://github.com/intlify/vue-i18n/releases/tag/v11.4.14"
},
{
"type": "WEB",
"url": "https://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.