CVE-2026-118257 Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-118257?
CVE-2026-118257 is a high-severity vulnerability in intlify vue-i18n, published on 28 Oct 2026.
Official description
Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.
Which versions are affected by CVE-2026-118257?
36 open source packages ship an affected version, including @intlify/vue-i18n-core, @intlify/core and @intlify/core-base.
| Package | Affected | Fixed in |
|---|---|---|
@intlify/vue-i18n-core npm | All versions | None |
@intlify/vue-i18n-core npm | All versions | None |
@intlify/vue-i18n-core npm | From 11.1.10 | 11.4.14 |
@intlify/vue-i18n-core npm | From 11.1.10 | 11.4.14 |
@intlify/vue-i18n-core npm | From 12.0.0-alpha.4 | 12.0.0-alpha.5 |
@intlify/vue-i18n-core npm | From 12.0.0-alpha.4 | 12.0.0-alpha.5 |
30 more packages
@intlify/core npm | All versions | None |
@intlify/core npm | All versions | None |
@intlify/core npm | From 11.1.10 | 11.4.14 |
@intlify/core npm | From 11.1.10 | 11.4.14 |
@intlify/core npm | From 12.0.0-alpha.4 | 12.0.0-alpha.5 |
@intlify/core npm | From 12.0.0-alpha.4 | 12.0.0-alpha.5 |
@intlify/core-base npm | All versions | None |
@intlify/core-base npm | All versions | None |
@intlify/core-base npm | From 11.1.10 | 11.4.14 |
@intlify/core-base npm | From 11.1.10 | 11.4.14 |
@intlify/core-base npm | From 12.0.0-alpha.4 | 12.0.0-alpha.5 |
@intlify/core-base npm | From 12.0.0-alpha.4 | 12.0.0-alpha.5 |
@intlify/shared npm | All versions | None |
@intlify/shared npm | All versions | None |
@intlify/shared npm | From 11.1.10 | 11.4.14 |
@intlify/shared npm | From 11.1.10 | 11.4.14 |
@intlify/shared npm | From 12.0.0-alpha.4 | 12.0.0-alpha.5 |
@intlify/shared npm | From 12.0.0-alpha.4 | 12.0.0-alpha.5 |
petite-vue-i18n npm | All versions | None |
petite-vue-i18n npm | All versions | None |
petite-vue-i18n npm | From 11.1.10 | 11.4.14 |
petite-vue-i18n npm | From 11.1.10 | 11.4.14 |
petite-vue-i18n npm | From 12.0.0-alpha.4 | 12.0.0-alpha.5 |
petite-vue-i18n npm | From 12.0.0-alpha.4 | 12.0.0-alpha.5 |
vue-i18n npm | All versions | None |
vue-i18n npm | All versions | None |
vue-i18n npm | From 11.1.10 | 11.4.14 |
vue-i18n npm | From 11.1.10 | 11.4.14 |
vue-i18n npm | From 12.0.0-alpha.4 | 12.0.0-alpha.5 |
vue-i18n npm | From 12.0.0-alpha.4 | 12.0.0-alpha.5 |
How do I fix CVE-2026-118257?
Upgrade @intlify/vue-i18n-core to a fixed version for your release line: 11.4.14 or 12.0.0-alpha.5.
Is CVE-2026-118257 being exploited?
There is no known exploitation of CVE-2026-118257 in the wild and no public exploit code.
Sources
Also known as GHSA-83rm-6c8r-g728.