CVE-2026-118256 Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-118256?
CVE-2026-118256 is a low-severity vulnerability in intlify vue-i18n, published on 28 Oct 2026.
Official description
Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.
Which versions are affected by CVE-2026-118256?
20 open source packages ship an affected version, including @intlify/vue-i18n-core, @intlify/core and @intlify/core-base.
| Package | Affected | Fixed in |
|---|---|---|
@intlify/vue-i18n-core npm | From 12.0.0-alpha.1 | 12.0.0-alpha.5 |
@intlify/vue-i18n-core npm | From 12.0.0-alpha.1 | 12.0.0-alpha.5 |
@intlify/vue-i18n-core npm | From 9.2.0-alpha.7 | 11.4.14 |
@intlify/vue-i18n-core npm | From 9.2.0-alpha.7 | 11.4.14 |
@intlify/core npm | From 12.0.0-alpha.1 | 12.0.0-alpha.5 |
@intlify/core npm | From 12.0.0-alpha.1 | 12.0.0-alpha.5 |
14 more packages
@intlify/core npm | From 9.0.0-beta.10 | 11.4.14 |
@intlify/core npm | From 9.0.0-beta.10 | 11.4.14 |
@intlify/core-base npm | From 12.0.0-alpha.1 | 12.0.0-alpha.5 |
@intlify/core-base npm | From 12.0.0-alpha.1 | 12.0.0-alpha.5 |
@intlify/core-base npm | From 9.0.0-beta.12 | 11.4.14 |
@intlify/core-base npm | From 9.0.0-beta.12 | 11.4.14 |
petite-vue-i18n npm | From 12.0.0-alpha.1 | 12.0.0-alpha.5 |
petite-vue-i18n npm | From 12.0.0-alpha.1 | 12.0.0-alpha.5 |
petite-vue-i18n npm | From 9.2.0-alpha.7 | 11.4.14 |
petite-vue-i18n npm | From 9.2.0-alpha.7 | 11.4.14 |
vue-i18n npm | From 12.0.0-alpha.1 | 12.0.0-alpha.5 |
vue-i18n npm | From 12.0.0-alpha.1 | 12.0.0-alpha.5 |
vue-i18n npm | From 9.0.0-beta.5 | 11.4.14 |
vue-i18n npm | From 9.0.0-beta.5 | 11.4.14 |
How do I fix CVE-2026-118256?
Upgrade @intlify/vue-i18n-core to a fixed version for your release line: 12.0.0-alpha.5 or 11.4.14.
Is CVE-2026-118256 being exploited?
There is no known exploitation of CVE-2026-118256 in the wild and no public exploit code.
Sources
Also known as GHSA-8rc2-428q-7ww3.