CVE-2026-118256

LowCVSS 2.1

Published: 28/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

41th percentile - higher than 41% of all known CVEs

Summary

Vue I18n from 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, when escapeParameter (escapeParameterHtml in Legacy API) is enabled, does not escape named interpolation values if the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications rendering translations as HTML with untrusted named values and a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and may allow script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. Fixed in 11.4.14 and 12.0.0-alpha.5.

Risk Assessment

An attacker can inject malicious HTML or scripts into rendered translations, enabling phishing, layout manipulation, or script execution in the user's browser. This poses a significant security risk to frontend applications.

Recommendation

Update Vue I18n to version 11.4.14 or 12.0.0-alpha.5. Do not pass untrusted named values together with lists to translations rendered as HTML.

Other vulnerabilities in Vue I18n

CVE-2026-118257High
Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Original NVD description (English source)

Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS