CVE-2025-53892 Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror
Attackers can execute arbitrary JavaScript via DOM-based XSS in Vue I18n when using v-html with escapeParameterHtml enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-53892?
CVE-2025-53892 is a medium-severity cross-site scripting vulnerability in intlify vue-i18n, published on 16 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as <img src=x onerror=...>, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue.
Weakness: CWE-79
Which versions are affected by CVE-2025-53892?
28 open source packages ship an affected version, including @intlify/vue-i18n-core, @intlify/core and @intlify/core-base.
| Package | Affected | Fixed in |
|---|---|---|
@intlify/vue-i18n-core npm | From 10.0.0 | 10.0.8 |
@intlify/vue-i18n-core npm | From 10.0.0 | 10.0.8 |
@intlify/vue-i18n-core npm | From 11.0.0 | 11.1.10 |
@intlify/vue-i18n-core npm | From 11.0.0 | 11.1.10 |
@intlify/vue-i18n-core npm | From 9.2.0 | 9.14.5 |
@intlify/vue-i18n-core npm | From 9.2.0 | 9.14.5 |
22 more packages
@intlify/core npm | From 10.0.0 | 10.0.8 |
@intlify/core npm | From 10.0.0 | 10.0.8 |
@intlify/core npm | From 11.0.0 | 11.1.10 |
@intlify/core npm | From 11.0.0 | 11.1.10 |
@intlify/core npm | From 9.0.0 | 9.14.5 |
@intlify/core npm | From 9.0.0 | 9.14.5 |
@intlify/core-base npm | From 10.0.0 | 10.0.8 |
@intlify/core-base npm | From 10.0.0 | 10.0.8 |
@intlify/core-base npm | From 11.0.0 | 11.1.10 |
@intlify/core-base npm | From 11.0.0 | 11.1.10 |
@intlify/core-base npm | From 9.0.0 | 9.14.5 |
@intlify/core-base npm | From 9.0.0 | 9.14.5 |
petite-vue-i18n npm | From 10.0.0 | 10.0.8 |
petite-vue-i18n npm | From 10.0.0 | 10.0.8 |
petite-vue-i18n npm | From 11.0.0 | 11.1.10 |
petite-vue-i18n npm | From 11.0.0 | 11.1.10 |
vue-i18n npm | From 10.0.0 | 10.0.8 |
vue-i18n npm | From 10.0.0 | 10.0.8 |
vue-i18n npm | From 11.0.0 | 11.1.10 |
vue-i18n npm | From 11.0.0 | 11.1.10 |
vue-i18n npm | From 9.0.0 | 9.14.5 |
vue-i18n npm | From 9.0.0 | 9.14.5 |
How do I fix CVE-2025-53892?
Upgrade @intlify/vue-i18n-core to a fixed version for your release line: 10.0.8, 11.1.10 or 9.14.5.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-53892 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53892 exists.
Sources
Also known as GHSA-x8qp-wqqm-57ph.