CVE-2026-118257

About vulnerability

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Affected product:

Vue , intlify-bundle-utils , intlify-core , intlify-core-base , intlify-devtools-types , intlify-h3 , intlify-message-compiler , intlify-shared , intlify-vue-i18n-core , petite-vue-i18n

Affected packages:

@intlify/shared @ 11.4.4 (+91 more)