Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.2 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS

• CVE-2026-118257: 0.27% estimated exploitation activity in the next 30 days; percentile 19.66 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary When `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n passes the translated string through `sanitizeTranslatedHtml()`. The sanitizer escapes ` ` in attribute values and neutralizes event handler attributes such as `onerror`, but it does not handle the `srcdoc` attribute of ` `. The value of `srcdoc` is an HTML document: the browser decodes the character references in it and parses the result as a nested document in the same origin. The escaping and the neutralization done by the sanitizer are both character references, so they are undone inside `srcdoc`. This bypasses the fix for CVE-2025-53892 (GHSA-x8qp-wqqm-57ph).

Details `sanitizeTranslatedHtml()` (`packages/shared/src/sanitize.ts` in v11.4.13) works on the final translated string: 1. It escapes ` `, `"` and `'` inside quoted attribute values. 2. It rewrites the `on` of event handler…

Published by the source

28 Oct 2026, 21:06 UTC

Last modified by the source

28 Oct 2026, 21:15 UTC

Source last checked

29 Oct 2026, 06:00 UTC

1. Revision 2 · amended · 29 Oct 2026

   Amended from osv record GHSA-83rm-6c8r-g728

2. Revision 1 · created · 28 Oct 2026

   Published from ghsa record GHSA-83rm-6c8r-g728

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-118257

Advisory: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
IDs: CVE-2026-118257, GHSA-83rm-6c8r-g728
Record: https://patchnext.com/advisories/cve-2026-118257 (revision 2, source checked 29 Oct 2026, 06:00 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.2)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Partial vendor fix; fixed versions by package: @intlify/shared 12.0.0-alpha.5, 11.4.14; @intlify/vue-i18n-core 12.0.0-alpha.5, 11.4.14; vue-i18n 12.0.0-alpha.5, 11.4.14; petite-vue-i18n 12.0.0-alpha.5, 11.4.14; @intlify/core-base 12.0.0-alpha.5, 11.4.14; @intlify/core 12.0.0-alpha.5, 11.4.14. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm @intlify/shared: affected >= 9.14.5, <= 9.14.5; >= 10.0.8, <= 10.0.8; >= 11.1.10, < 11.4.14; >= 12.0.0-alpha.4, < 12.0.0-alpha.5; fixed in 12.0.0-alpha.5, 11.4.14
- npm @intlify/vue-i18n-core: affected >= 9.14.5, <= 9.14.5; >= 10.0.8, <= 10.0.8; >= 11.1.10, < 11.4.14; >= 12.0.0-alpha.4, < 12.0.0-alpha.5; fixed in 12.0.0-alpha.5, 11.4.14
- npm vue-i18n: affected >= 9.14.5, <= 9.14.5; >= 10.0.8, <= 10.0.8; >= 11.1.10, < 11.4.14; >= 12.0.0-alpha.4, < 12.0.0-alpha.5; fixed in 12.0.0-alpha.5, 11.4.14
- npm petite-vue-i18n: affected >= 9.14.5, <= 9.14.5; >= 10.0.8, <= 10.0.8; >= 11.1.10, < 11.4.14; >= 12.0.0-alpha.4, < 12.0.0-alpha.5; fixed in 12.0.0-alpha.5, 11.4.14
- npm @intlify/core-base: affected >= 9.14.5, <= 9.14.5; >= 10.0.8, <= 10.0.8; >= 11.1.10, < 11.4.14; >= 12.0.0-alpha.4, < 12.0.0-alpha.5; fixed in 12.0.0-alpha.5, 11.4.14
- npm @intlify/core: affected >= 9.14.5, <= 9.14.5; >= 10.0.8, <= 10.0.8; >= 11.1.10, < 11.4.14; >= 12.0.0-alpha.4, < 12.0.0-alpha.5; fixed in 12.0.0-alpha.5, 11.4.14

## Suggested inspection (read-only)
- `npm ls @intlify/shared --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @intlify/vue-i18n-core --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls vue-i18n --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls petite-vue-i18n --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @intlify/core-base --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @intlify/core --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on @intlify/shared, @intlify/vue-i18n-core, vue-i18n, petite-vue-i18n, @intlify/core-base, @intlify/core.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-83rm-6c8r-g728 (GitHub-reviewed advisory GHSA-83rm-6c8r-g728 lists affected ranges: npm vue-i18n >=9.14.5 =10.0.8 =11.1.10 =12.0.0-alpha.4 =9.14.5 =10.0.8 =11.1.10 =12.0.0-alpha.4 =9.14.5 =10.0.8 =11.1.10 =12.0.0-alpha.4 =9.14.5 =10.0.8 =11.1.10 =12.0.0-alpha.4…)
- Verified: https://osv.dev/vulnerability/GHSA-83rm-6c8r-g728 (OSV record GHSA-83rm-6c8r-g728 lists affected ranges: npm vue-i18n >=9.14.5 =10.0.8 =11.1.10 =12.0.0-alpha.4 =9.14.5 =10.0.8 =11.1.10 =12.0.0-alpha.4 =9.14.5 =10.0.8 =11.1.10 =12.0.0-alpha.4 =9.14.5 =10.0.8 <=10.0.8,…)

Commands are suggestions: review each one before running it.