CVE-2024-52809 Cross-site Scripting vulnerability with prototype pollution in vue-i18n
Attackers can execute arbitrary scripts via prototype pollution in development mode when using vue-i18n, requiring an upgrade to secure the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-52809?
CVE-2024-52809 is a medium-severity cross-site scripting vulnerability in intlify vue-i18n, published on 29 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibility of Cross-site Scripting attack. This issue has been addressed in versions 9.14.2, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-79
Which versions are affected by CVE-2024-52809?
18 open source packages ship an affected version, including @intlify/vue-i18n-core, @intlify/core and @intlify/core-base.
| Package | Affected | Fixed in |
|---|---|---|
@intlify/vue-i18n-core npm | From 10.0.0 | 10.0.5 |
@intlify/vue-i18n-core npm | From 10.0.0 | 10.0.5 |
@intlify/vue-i18n-core npm | From 9.3.0 | 9.14.2 |
@intlify/vue-i18n-core npm | From 9.3.0 | 9.14.2 |
@intlify/core npm | From 10.0.0 | 10.0.5 |
@intlify/core npm | From 10.0.0 | 10.0.5 |
12 more packages
@intlify/core npm | From 9.3.0 | 9.14.2 |
@intlify/core npm | From 9.3.0 | 9.14.2 |
@intlify/core-base npm | From 10.0.0 | 10.0.5 |
@intlify/core-base npm | From 10.0.0 | 10.0.5 |
@intlify/core-base npm | From 9.3.0 | 9.14.2 |
@intlify/core-base npm | From 9.3.0 | 9.14.2 |
petite-vue-i18n npm | From 10.0.0 | 10.0.5 |
petite-vue-i18n npm | From 10.0.0 | 10.0.5 |
vue-i18n npm | From 10.0.0 | 10.0.5 |
vue-i18n npm | From 10.0.0 | 10.0.5 |
vue-i18n npm | From 9.3.0 | 9.14.2 |
vue-i18n npm | From 9.3.0 | 9.14.2 |
How do I fix CVE-2024-52809?
Upgrade @intlify/vue-i18n-core to a fixed version for your release line: 10.0.5 or 9.14.2.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-52809 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-52809 exists.
Sources
Also known as GHSA-9r9m-ffp6-9x4v.