Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-118257— Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Quick assessment

Affected

intlify vue-i18n

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Vue I18n 是 Vue.js 的国际化插件。在版本 11.1.10 至 11.4.14，以及 12.0.0-alpha.4 至 12.0.0-alpha.5 期间，函数会对 iframe 的属性值中的标记（markup）和事件处理器文本进行转义，但并未禁用属性本身。浏览器会解码其中的字符引用，并将该值解析为同源嵌套的 HTML 文档。因此，当应用启用了并通过将翻译内容以 HTML 形式渲染时，攻击者可通过控制参数或翻译内容注入到中，从而执行恶意脚本。版本 9.14.5 和 10.0.8 同样受影响

CVSS 7.2 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 4

Vendor	Product	Version Range	Status
intlify	vue-i18n	`= 9.14.5`	affected
		`= 10.0.8`	affected
		`>= 11.1.10, < 11.4.14`	affected
		`>= 12.0.0-alpha.4, < 12.0.0-alpha.5`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Source: CVE Program / CVE List V5

Vulnerability Description

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
intlify	vue-i18n	= 9.14.5	-

II. Public POCs for CVE-2026-118257

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118257

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-118257 (2)

Vendor Advisories for CVE-2026-118257 (1)

🔗 sanitizeTranslatedHtml allows DOM XSS via iframe srcdoc · Advisory · intlify/vue-i18n · GitHub Read full article x_refsource_CONFIRM

Vendor Pages for CVE-2026-118257 (1)

🔗 Release v11.4.14 · intlify/vue-i18n · GitHub x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-118257

IV. Related Vulnerabilities

Same product: vue-i18n

Same vendor: intlify

Same weakness: CWE-79