EUVD-2026-112359Published

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

cve-program · CVE-2026-118257

Published

vue-i18n

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "intlify",
                    "product": "vue-i18n",
                    "versions": [
                        {
                            "version": "= 9.14.5",
                            "status": "affected"
                        },
                        {
                            "version": "= 10.0.8",
                            "status": "affected"
                        },
                        {
                            "version": ">= 11.1.10, < 11.4.14",
                            "status": "affected"
                        },
                        {
                            "version": ">= 12.0.0-alpha.4, < 12.0.0-alpha.5",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-112359

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Oct 28, 2026, 6:23:49 PM

dateUpdated: Oct 29, 2026, 8:55:05 PM

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-118257

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Awaiting Analysis

Weakness classifications: CWE-79 · CWE-116

Original publisher date fields

published: 2026-10-28T19:17:30.207

lastModified: 2026-10-29T21:17:15.557

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-83rm-6c8r-g728

Published

vue-i18n

npm

1 explicitly affected versions

9.14.5

vue-i18n

npm

1 explicitly affected versions

10.0.8

vue-i18n

npm

SEMVER · introduced 11.1.10 → fixed 11.4.14

vue-i18n

npm

SEMVER · introduced 12.0.0-alpha.4 → fixed 12.0.0-alpha.5

1 explicitly affected versions

12.0.0-alpha.4

petite-vue-i18n

npm

1 explicitly affected versions

9.14.5

petite-vue-i18n

npm

1 explicitly affected versions

10.0.8

petite-vue-i18n

npm

SEMVER · introduced 11.1.10 → fixed 11.4.14

petite-vue-i18n

npm

SEMVER · introduced 12.0.0-alpha.4 → fixed 12.0.0-alpha.5

1 explicitly affected versions

12.0.0-alpha.4

@intlify/core-base

npm

1 explicitly affected versions

9.14.5

@intlify/core-base

npm

1 explicitly affected versions

10.0.8

@intlify/core-base

npm

SEMVER · introduced 11.1.10 → fixed 11.4.14

@intlify/core-base

npm

SEMVER · introduced 12.0.0-alpha.4 → fixed 12.0.0-alpha.5

1 explicitly affected versions

12.0.0-alpha.4

@intlify/core

npm

1 explicitly affected versions

9.14.5

@intlify/core

npm

1 explicitly affected versions

10.0.8

@intlify/core

npm

SEMVER · introduced 11.1.10 → fixed 11.4.14

@intlify/core

npm

SEMVER · introduced 12.0.0-alpha.4 → fixed 12.0.0-alpha.5

1 explicitly affected versions

12.0.0-alpha.4

@intlify/vue-i18n-core

npm

1 explicitly affected versions

9.14.5

@intlify/vue-i18n-core

npm

1 explicitly affected versions

10.0.8

@intlify/vue-i18n-core

npm

SEMVER · introduced 11.1.10 → fixed 11.4.14

@intlify/vue-i18n-core

npm

SEMVER · introduced 12.0.0-alpha.4 → fixed 12.0.0-alpha.5

1 explicitly affected versions

12.0.0-alpha.4

@intlify/shared

npm

1 explicitly affected versions

9.14.5

@intlify/shared

npm

1 explicitly affected versions

10.0.8

@intlify/shared

npm

SEMVER · introduced 11.1.10 → fixed 11.4.14

@intlify/shared

npm

SEMVER · introduced 12.0.0-alpha.4 → fixed 12.0.0-alpha.5

1 explicitly affected versions

12.0.0-alpha.4

Original source record · Cite this exact observation · Complete original publisher JSON