{"id":"EUVD-2026-112359","enisaUuid":"689a8854-34fb-32a2-9fbe-e38cc5bba6f7","description":"Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.","datePublished":"Oct 28, 2026, 6:23:49 PM","dateUpdated":"Oct 29, 2026, 8:55:05 PM","baseScore":7.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","references":"https://github.com/intlify/vue-i18n/security/advisories/GHSA-83rm-6c8r-g728\nhttps://github.com/intlify/vue-i18n/pull/2679\nhttps://github.com/intlify/vue-i18n/commit/43391d20e7c85403cb59bdb21b5d542819f54042\nhttps://github.com/intlify/vue-i18n/releases/tag/v11.4.14\nhttps://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5\n","aliases":"CVE-2026-118257\nGHSA-83rm-6c8r-g728\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"5fd86893-a0c2-3f60-88ad-d6529e91857e","product":{"name":"vue-i18n","vendor":{"name":"intlify"}},"product_version":"12.0.0-alpha.4, \u003c 12.0.0-alpha.5"},{"id":"61b8a731-f293-3055-81c7-d9c86dd34fd0","product":{"name":"vue-i18n","vendor":{"name":"intlify"}},"product_version":"\u003d 10.0.8"},{"id":"6b2f2de2-55a7-3a10-b959-f22c5686ae3c","product":{"name":"vue-i18n","vendor":{"name":"intlify"}},"product_version":"\u003d 9.14.5"},{"id":"b1bd839c-032b-30cf-b94a-815318ea0c25","product":{"name":"vue-i18n","vendor":{"name":"intlify"}},"product_version":"11.1.10, \u003c 11.4.14"}],"enisaIdVendor":[{"id":"9ce154bc-a768-3498-bbc7-e2b7a2125cc3","vendor":{"name":"intlify"}}],"enisaIdVulnerability":[{"id":"65af0fb0-31a3-3cf5-8a3b-201341961c56","vulnerability":{"id":"GHSA-83rm-6c8r-g728","description":"Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages","datePublished":"Oct 28, 2026, 9:06:24 PM","dateUpdated":"Oct 28, 2026, 9:06:24 PM","baseScore":0.0,"references":"https://github.com/intlify/vue-i18n/security/advisories/GHSA-83rm-6c8r-g728\nhttps://github.com/intlify/vue-i18n/pull/2679\nhttps://github.com/intlify/vue-i18n/commit/43391d20e7c85403cb59bdb21b5d542819f54042\nhttps://github.com/intlify/vue-i18n\nhttps://github.com/intlify/vue-i18n/releases/tag/v11.4.14\nhttps://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5\n","enisa_id":"EUVD-2026-112359\n","aliases":"CVE-2026-118257\nGHSA-83rm-6c8r-g728\n","epss":0.0,"dataProcessed":"Nov 3, 2026, 7:03:11 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f1ae8889-99d5-322b-a642-2b8fecd47e85","vulnerability":{"id":"CVE-2026-118257","description":"Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.","datePublished":"Oct 28, 2026, 6:23:49 PM","dateUpdated":"Oct 29, 2026, 8:55:05 PM","status":"PUBLISHED","baseScore":7.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","references":"https://github.com/intlify/vue-i18n/security/advisories/GHSA-83rm-6c8r-g728\nhttps://github.com/intlify/vue-i18n/pull/2679\nhttps://github.com/intlify/vue-i18n/commit/43391d20e7c85403cb59bdb21b5d542819f54042\nhttps://github.com/intlify/vue-i18n/releases/tag/v11.4.14\nhttps://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5\n","enisa_id":"EUVD-2026-112359\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Nov 3, 2026, 7:15:55 AM","vulnerabilityProduct":[{"id":"232b6d26-79f0-3380-8033-e3e25eab0dd5","product":{"name":"vue-i18n","vendor":{"name":"intlify"}},"product_version":"11.1.10, \u003c 11.4.14"},{"id":"702d5aa9-ba24-3dfc-a93e-06376e0b2657","product":{"name":"vue-i18n","vendor":{"name":"intlify"}},"product_version":"12.0.0-alpha.4, \u003c 12.0.0-alpha.5"},{"id":"8703a245-382e-3d57-b6c6-d0feca336d4c","product":{"name":"vue-i18n","vendor":{"name":"intlify"}},"product_version":"\u003d 9.14.5"},{"id":"9d6fba84-b8bf-3d3c-8466-0419ed05ef53","product":{"name":"vue-i18n","vendor":{"name":"intlify"}},"product_version":"\u003d 10.0.8"}],"vulnerabilityVendor":[{"id":"dadd2788-76df-3f97-b1ba-a8b9c40d5ef1","vendor":{"name":"intlify"}}]}}],"enisaIdAdvisory":[]}