CVE-2026-118256Published
Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-118256 · Microsoft / collected KEV context
cve-program · CVE-2026-118256
- https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3
- https://github.com/intlify/vue-i18n/pull/2680
- https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8
euvd · EUVD-2026-112358
- https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3
- https://github.com/intlify/vue-i18n/pull/2680
- https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8
nvd · CVE-2026-118256
- https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8
- https://github.com/intlify/vue-i18n/pull/2680
- https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3
osv · GHSA-8rc2-428q-7ww3
- https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3
- https://github.com/intlify/vue-i18n/pull/2680
- https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8
- https://github.com/intlify/vue-i18n
- https://github.com/intlify/vue-i18n/releases/tag/v11.4.14
- https://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5
Related operational evidence
Explicit CVE identifiers- Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same tra… · Advisory content revised · 30 Oct 2026
- Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same tra… · Advisory content revised · 30 Oct 2026
- Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list · Newly collected advisory · 28 Oct 2026
- Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list · Newly collected advisory · 28 Oct 2026