cyfenced.com →

[ CVE-2026-118256 · Published 28 Oct 2026 ]

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

CVSS 2.1 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

[ Fixes ]Fixes and patches

  • vue-i18n 11.4.14Fixed version · GitHub Advisories · npm package vue-i18n: upgrade to 11.4.14 or later (affected >= 9.0.0-beta.5, < 11.4.14)
  • vue-i18n 12.0.0-alpha.5Fixed version · GitHub Advisories · npm package vue-i18n: upgrade to 12.0.0-alpha.5 or later (affected >= 12.0.0-alpha.1, < 12.0.0-alpha.5)
  • @intlify/core 11.4.14Fixed version · GitHub Advisories · npm package @intlify/core: upgrade to 11.4.14 or later (affected >= 9.0.0-beta.10, < 11.4.14)
  • @intlify/core 12.0.0-alpha.5Fixed version · GitHub Advisories · npm package @intlify/core: upgrade to 12.0.0-alpha.5 or later (affected >= 12.0.0-alpha.1, < 12.0.0-alpha.5)
  • @intlify/core-base 11.4.14Fixed version · GitHub Advisories · npm package @intlify/core-base: upgrade to 11.4.14 or later (affected >= 9.0.0-beta.12, < 11.4.14)
  • @intlify/core-base 12.0.0-alpha.5Fixed version · GitHub Advisories · npm package @intlify/core-base: upgrade to 12.0.0-alpha.5 or later (affected >= 12.0.0-alpha.1, < 12.0.0-alpha.5)
  • petite-vue-i18n 11.4.14Fixed version · GitHub Advisories · npm package petite-vue-i18n: upgrade to 11.4.14 or later (affected >= 9.2.0-alpha.7, < 11.4.14)
  • petite-vue-i18n 12.0.0-alpha.5Fixed version · GitHub Advisories · npm package petite-vue-i18n: upgrade to 12.0.0-alpha.5 or later (affected >= 12.0.0-alpha.1, < 12.0.0-alpha.5)
  • @intlify/vue-i18n-core 11.4.14Fixed version · GitHub Advisories · npm package @intlify/vue-i18n-core: upgrade to 11.4.14 or later (affected >= 9.2.0-alpha.7, < 11.4.14)
  • @intlify/vue-i18n-core 12.0.0-alpha.5Fixed version · GitHub Advisories · npm package @intlify/vue-i18n-core: upgrade to 12.0.0-alpha.5 or later (affected >= 12.0.0-alpha.1, < 12.0.0-alpha.5)

[ Packages ]Affected open-source packages

  • vue-i18n npmAffected >= 9.0.0-beta.5, < 11.4.14 · fixed in 11.4.14 · GHSA-8rc2-428q-7ww3
  • vue-i18n npmAffected >= 12.0.0-alpha.1, < 12.0.0-alpha.5 · fixed in 12.0.0-alpha.5 · GHSA-8rc2-428q-7ww3
  • @intlify/core npmAffected >= 9.0.0-beta.10, < 11.4.14 · fixed in 11.4.14 · GHSA-8rc2-428q-7ww3
  • @intlify/core npmAffected >= 12.0.0-alpha.1, < 12.0.0-alpha.5 · fixed in 12.0.0-alpha.5 · GHSA-8rc2-428q-7ww3
  • @intlify/core-base npmAffected >= 9.0.0-beta.12, < 11.4.14 · fixed in 11.4.14 · GHSA-8rc2-428q-7ww3
  • @intlify/core-base npmAffected >= 12.0.0-alpha.1, < 12.0.0-alpha.5 · fixed in 12.0.0-alpha.5 · GHSA-8rc2-428q-7ww3
  • petite-vue-i18n npmAffected >= 9.2.0-alpha.7, < 11.4.14 · fixed in 11.4.14 · GHSA-8rc2-428q-7ww3
  • petite-vue-i18n npmAffected >= 12.0.0-alpha.1, < 12.0.0-alpha.5 · fixed in 12.0.0-alpha.5 · GHSA-8rc2-428q-7ww3
  • @intlify/vue-i18n-core npmAffected >= 9.2.0-alpha.7, < 11.4.14 · fixed in 11.4.14 · GHSA-8rc2-428q-7ww3
  • @intlify/vue-i18n-core npmAffected >= 12.0.0-alpha.1, < 12.0.0-alpha.5 · fixed in 12.0.0-alpha.5 · GHSA-8rc2-428q-7ww3

[ References ]References