{"id":"EUVD-2026-112358","revision":null,"records":[{"revision":"30f65d2d38af41f58262f6b83fc89b1c","observedAt":"2026-10-30T15:45:26.77+00:00","statement":{"source":"cve-program","id":"CVE-2026-118256","aliases":[],"title":"Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list","description":"Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.","state":0,"publishedAt":"2026-10-28T18:20:14.644+00:00","modifiedAt":"2026-10-30T14:19:32.716+00:00","affected":[{"ecosystem":"Vendor product","name":"vue-i18n","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"intlify\",\n                    \"product\": \"vue-i18n\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 9.0.0-beta.5, < 11.4.14\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 12.0.0-alpha.1, < 12.0.0-alpha.5\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","score":2.1,"severity":"LOW"}],"references":["https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3","https://github.com/intlify/vue-i18n/pull/2680","https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118256","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-118256","identifiers":["CVE-2026-118256"]},"retained":false,"historicalAffected":[]},{"revision":"4da7dd7487a34d9db194bcd26cda000a","observedAt":"2026-11-06T00:45:08.121+00:00","statement":{"source":"euvd","id":"EUVD-2026-112358","aliases":["CVE-2026-118256","GHSA-8rc2-428q-7ww3"],"title":"Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same tra…","description":"Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","score":2.1,"severity":null}],"references":["https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3","https://github.com/intlify/vue-i18n/pull/2680","https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112358","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 28, 2026, 6:20:14 PM","dateUpdated":"Oct 30, 2026, 2:19:32 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-112358","identifiers":["EUVD-2026-112358","CVE-2026-118256","GHSA-8rc2-428q-7ww3"]},"retained":false,"historicalAffected":[]},{"revision":"46990acffbe94acb8d4ae002d63d320f","observedAt":"2026-10-30T22:45:44.312+00:00","statement":{"source":"nvd","id":"CVE-2026-118256","aliases":[],"title":"Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same tra…","description":"Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.","state":0,"publishedAt":"2026-10-28T19:17:30.06+00:00","modifiedAt":"2026-10-30T15:16:47.017+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":2.1,"severity":"LOW"}],"references":["https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8","https://github.com/intlify/vue-i18n/pull/2680","https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-118256","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-79","CWE-116"],"productCriteria":[],"sourceDates":{"published":"2026-10-28T19:17:30.060","lastModified":"2026-10-30T15:16:47.017"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-118256","identifiers":["CVE-2026-118256"]},"retained":false,"historicalAffected":[]},{"revision":"b0e21560c7c84bbda5ffa865625a15a3","observedAt":"2026-10-28T21:55:29.474+00:00","statement":{"source":"osv","id":"GHSA-8rc2-428q-7ww3","aliases":["CVE-2026-118256"],"title":"Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list","description":"### Summary\n\nWhen `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. `escapeParams()` escapes either the list values or the named values, but not both: the two branches are joined by `else`. When a single call passes both, for example `t(key, ['...'], { named: { ... } })`, the named values reach the message without being escaped.\n\n### Details\n\n`escapeParams()` in [`packages/core-base/src/translate.ts` (v11.4.13)](https://github.com/intlify/vue-i18n/blob/v11.4.13/packages/core-base/src/translate.ts):\n\n```ts\nfunction escapeParams(options: TranslateOptions) {\n  if (isArray(options.list)) {\n    options.list = options.list.map(item => (isString(item) ? escapeHtml(item) : item))\n  } else if (isObject(options.named)) {\n    // ...escapes the named values\n  }\n}\n```\n\n`t(key, list, options)` is a public overload, and `TranslateOptions` has a `named` field, so a call can carry both. The list is checked first, and the named values are then left as they are.\n\nThe translated string still goes through `sanitizeTranslatedHtml()` (added for CVE-2025-53892), which neutralizes event handler attributes and `javascript:` URLs. Other markup in the named values, such as links and forms, is inserted as is. Before the fix for GHSA-83rm-6c8r-g728, an `<iframe srcdoc>` in a named value also passes the sanitizer, and script runs. Versions without the sanitizer (before 9.14.5, 10.0.8 and 11.1.10, and 12.0.0-alpha.1 to alpha.3) insert the named values as HTML without any further check.\n\n`<i18n-t>` is not affected: it passes either list or named values, never both, and it does not render translations as HTML.\n\n### PoC\n\n```js\nimport { createI18n } from 'vue-i18n'\n\nconst i18n = createI18n({\n  legacy: false,\n  locale: 'en',\n  escapeParameter: true,\n  messages: {\n    en: { withList: '{0} {name}', withoutList: '{name}' }\n  }\n})\nconst t = i18n.global.t\n\nt('withoutList', { name: '<b>x</b>' })\n// &lt;b&gt;x&lt;&#x2F;b&gt;      escaped\n\nt('withList', ['a'], { named: { name: '<b>x</b>' } })\n// a <b>x</b>                   not escaped (v11.4.13)\n```\n\n### Impact\n\nApplications are affected when they enable `escapeParameter`, render translations as HTML (for example with `v-html`), and pass untrusted named values in the same call as a list. The named values are inserted as markup: phishing links, forms, or layout changes. Together with GHSA-83rm-6c8r-g728, or on versions without the sanitizer, this leads to script execution (DOM-based XSS).\n\n### Patches\n\nFixed in 11.4.14 and 12.0.0-alpha.5. `escapeParams()` now escapes both the list and the named values.\n\nThe fix also stops rewriting the named object that the caller passes. Before, the values of that object were replaced with their escaped form, so a second call with the same object escaped them twice.\n\nv9 and v10 are no longer supported and will not be fixed. Please migrate to v11.\n\n### Workarounds\n\n- Do not pass list and named values in the same call when `escapeParameter` is enabled.\n- Do not render translations that can contain untrusted values with `v-html`. Use component interpolation (`<i18n-t>`) instead.","state":0,"publishedAt":"2026-10-28T21:06:34+00:00","modifiedAt":"2026-10-28T21:15:04.1466164+00:00","affected":[{"ecosystem":"npm","name":"vue-i18n","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"9.0.0-beta.5"},{"kind":"fixed","version":"11.4.14"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"vue-i18n","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"12.0.0-alpha.1"},{"kind":"fixed","version":"12.0.0-alpha.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@intlify/core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"9.0.0-beta.10"},{"kind":"fixed","version":"11.4.14"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@intlify/core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"12.0.0-alpha.1"},{"kind":"fixed","version":"12.0.0-alpha.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@intlify/core-base","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"9.0.0-beta.12"},{"kind":"fixed","version":"11.4.14"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@intlify/core-base","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"12.0.0-alpha.1"},{"kind":"fixed","version":"12.0.0-alpha.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"petite-vue-i18n","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"9.2.0-alpha.7"},{"kind":"fixed","version":"11.4.14"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"petite-vue-i18n","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"12.0.0-alpha.1"},{"kind":"fixed","version":"12.0.0-alpha.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@intlify/vue-i18n-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"9.2.0-alpha.7"},{"kind":"fixed","version":"11.4.14"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@intlify/vue-i18n-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"12.0.0-alpha.1"},{"kind":"fixed","version":"12.0.0-alpha.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3","https://github.com/intlify/vue-i18n/pull/2680","https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8","https://github.com/intlify/vue-i18n","https://github.com/intlify/vue-i18n/releases/tag/v11.4.14","https://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5"],"sourceUrl":"https://github.com/advisories/GHSA-8rc2-428q-7ww3","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-8rc2-428q-7ww3","identifiers":["GHSA-8rc2-428q-7ww3","CVE-2026-118256"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T09:27:02.0881180+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T09:27:02.088118+00:00","lastSuccessAt":"2026-11-07T09:27:02.275552+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:02.2755528+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-119922d4652e19b255c332c622ccf0862cc635682e2e6107e0a24821a354707e","complete":true,"records":420779,"lastAttemptAt":"2026-11-07T09:27:01.2826732+00:00","lastSuccessAt":"2026-11-07T09:27:01.2301134+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:01.2826732+00:00","snapshotPublishedAt":"2026-11-07T09:18:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b52a1e8adeec4da689c82b3880ed1f86","complete":true,"records":13631,"lastAttemptAt":"2026-11-07T09:38:22.8963621+00:00","lastSuccessAt":"2026-11-07T09:38:22.887+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:38:22.887+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T09:27:02.0881180+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T09:27:02.088118+00:00","lastSuccessAt":"2026-11-07T09:27:02.2763671+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:02.2763676+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1262a9fa83024e28a1560dfc0c9cdf3c","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T09:27:03.0678524+00:00","lastSuccessAt":"2026-11-07T06:27:08.533+00:00","error":null,"lastVerifiedAt":"2026-11-07T06:27:08.533+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T09:27:01.6721049+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:01.6721049+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T09:27:01.4581125+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:01.4581125+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T09:27:02.0484184+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:02.0484184+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-a0b728bc1c5526b5429930c00621636eba8655069c176697c3080f8377619ad7","complete":true,"records":231291,"lastAttemptAt":"2026-11-07T09:27:01.5654151+00:00","lastSuccessAt":"2026-11-07T00:28:51.1983528+00:00","error":null,"lastVerifiedAt":"2026-11-07T09:27:01.5654151+00:00","snapshotPublishedAt":"2026-11-06T23:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}