GHSA-83rm-6c8r-g728Published

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Exact source revision recorded 28 Oct 2026 21:55:29 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

osv · GHSA-83rm-6c8r-g728

Published

vue-i18n

npm

1 explicitly affected versions

9.14.5

vue-i18n

npm

1 explicitly affected versions

10.0.8

vue-i18n

npm

SEMVER · introduced 11.1.10 → fixed 11.4.14

vue-i18n

npm

SEMVER · introduced 12.0.0-alpha.4 → fixed 12.0.0-alpha.5

1 explicitly affected versions

12.0.0-alpha.4

petite-vue-i18n

npm

1 explicitly affected versions

9.14.5

petite-vue-i18n

npm

1 explicitly affected versions

10.0.8

petite-vue-i18n

npm

SEMVER · introduced 11.1.10 → fixed 11.4.14

petite-vue-i18n

npm

SEMVER · introduced 12.0.0-alpha.4 → fixed 12.0.0-alpha.5

1 explicitly affected versions

12.0.0-alpha.4

@intlify/core-base

npm

1 explicitly affected versions

9.14.5

@intlify/core-base

npm

1 explicitly affected versions

10.0.8

@intlify/core-base

npm

SEMVER · introduced 11.1.10 → fixed 11.4.14

@intlify/core-base

npm

SEMVER · introduced 12.0.0-alpha.4 → fixed 12.0.0-alpha.5

1 explicitly affected versions

12.0.0-alpha.4

@intlify/core

npm

1 explicitly affected versions

9.14.5

@intlify/core

npm

1 explicitly affected versions

10.0.8

@intlify/core

npm

SEMVER · introduced 11.1.10 → fixed 11.4.14

@intlify/core

npm

SEMVER · introduced 12.0.0-alpha.4 → fixed 12.0.0-alpha.5

1 explicitly affected versions

12.0.0-alpha.4

@intlify/vue-i18n-core

npm

1 explicitly affected versions

9.14.5

@intlify/vue-i18n-core

npm

1 explicitly affected versions

10.0.8

@intlify/vue-i18n-core

npm

SEMVER · introduced 11.1.10 → fixed 11.4.14

@intlify/vue-i18n-core

npm

SEMVER · introduced 12.0.0-alpha.4 → fixed 12.0.0-alpha.5

1 explicitly affected versions

12.0.0-alpha.4

@intlify/shared

npm

1 explicitly affected versions

9.14.5

@intlify/shared

npm

1 explicitly affected versions

10.0.8

@intlify/shared

npm

SEMVER · introduced 11.1.10 → fixed 11.4.14

@intlify/shared

npm

SEMVER · introduced 12.0.0-alpha.4 → fixed 12.0.0-alpha.5

1 explicitly affected versions

12.0.0-alpha.4

Original source record · Cite this exact observation · Complete original publisher JSON