---
id: CVE-2026-118256
aliases:
  - GHSA-8rc2-428q-7ww3
title: >-
  Vue I18n: `escapeParameter` does not escape named values when the same call
  also passes a list
summary: >-
  Vue I18n: `escapeParameter` does not escape named values when the same call
  also passes a list
severity: low
cwe:
  - CWE-79
  - CWE-116
vendor: vue-i18n
product: vue-i18n
ecosystem: npm
affected:
  - 'vue-i18n >= 9.0.0-beta.5, < 11.4.14'
  - 'vue-i18n >= 12.0.0-alpha.1, < 12.0.0-alpha.5'
  - '@intlify/core >= 9.0.0-beta.10, < 11.4.14'
  - '@intlify/core >= 12.0.0-alpha.1, < 12.0.0-alpha.5'
  - '@intlify/core-base >= 9.0.0-beta.12, < 11.4.14'
  - '@intlify/core-base >= 12.0.0-alpha.1, < 12.0.0-alpha.5'
  - 'petite-vue-i18n >= 9.2.0-alpha.7, < 11.4.14'
  - 'petite-vue-i18n >= 12.0.0-alpha.1, < 12.0.0-alpha.5'
  - '@intlify/vue-i18n-core >= 9.2.0-alpha.7, < 11.4.14'
  - '@intlify/vue-i18n-core >= 12.0.0-alpha.1, < 12.0.0-alpha.5'
patched:
  - vue-i18n 11.4.14
  - vue-i18n 12.0.0-alpha.5
  - '@intlify/core 11.4.14'
  - '@intlify/core 12.0.0-alpha.5'
  - '@intlify/core-base 11.4.14'
  - '@intlify/core-base 12.0.0-alpha.5'
  - petite-vue-i18n 11.4.14
  - petite-vue-i18n 12.0.0-alpha.5
  - '@intlify/vue-i18n-core 11.4.14'
  - '@intlify/vue-i18n-core 12.0.0-alpha.5'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T21:06:35Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-8rc2-428q-7ww3'
references:
  - url: >-
      https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3
  - url: 'https://github.com/intlify/vue-i18n/pull/2680'
  - url: >-
      https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8
  - url: 'https://github.com/intlify/vue-i18n/releases/tag/v11.4.14'
  - url: 'https://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5'
  - url: 'https://github.com/advisories/GHSA-8rc2-428q-7ww3'
tags:
  - ghsa
  - npm
ingestedAt: '2026-10-28T21:18:49.943Z'
---

## Overview

### Summary

When `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. `escapeParams()` escapes either the list values or the named values, but not both: the two branches are joined by `else`. When a single call passes both, for example `t(key, ['...'], { named: { ... } })`, the named values reach the message without being escaped.

### Details

`escapeParams()` in [`packages/core-base/src/translate.ts` (v11.4.13)](https://github.com/intlify/vue-i18n/blob/v11.4.13/packages/core-base/src/translate.ts):

```ts
function escapeParams(options: TranslateOptions) {
  if (isArray(options.list)) {
    options.list = options.list.map(item => (isString(item) ? escapeHtml(item) : item))
  } else if (isObject(options.named)) {
    // ...escapes the named values
  }
}
```

`t(key, list, options)` is a public overload, and `TranslateOptions` has a `named` field, so a call can carry both. The list is checked first, and the named values are then left as they are.

The translated string still goes through `sanitizeTranslatedHtml()` (added for CVE-2025-53892), which neutralizes event handler attributes and `javascript:` URLs. Other markup in the named values, such as links and forms, is inserted as is. Before the fix for GHSA-83rm-6c8r-g728, an `<iframe srcdoc>` in a named value also passes the sanitizer, and script runs. Versions without the sanitizer (before 9.14.5, 10.0.8 and 11.1.10, and 12.0.0-alpha.1 to alpha.3) insert the named values as HTML without any further check.

`<i18n-t>` is not affected: it passes either list or named values, never both, and it does not render translations as HTML.

### PoC

```js
import { createI18n } from 'vue-i18n'

const i18n = createI18n({
  legacy: false,
  locale: 'en',
  escapeParameter: true,
  messages: {
    en: { withList: '{0} {name}', withoutList: '{name}' }
  }
})
const t = i18n.global.t

t('withoutList', { name: '<b>x</b>' })
// &lt;b&gt;x&lt;&#x2F;b&gt;      escaped

t('withList', ['a'], { named: { name: '<b>x</b>' } })
// a <b>x</b>                   not escaped (v11.4.13)
```

### Impact

Applications are affected when they enable `escapeParameter`, render translations as HTML (for example with `v-html`), and pass untrusted named values in the same call as a list. The named values are inserted as markup: phishing links, forms, or layout changes. Together with GHSA-83rm-6c8r-g728, or on versions without the sanitizer, this leads to script execution (DOM-based XSS).

### Patches

Fixed in 11.4.14 and 12.0.0-alpha.5. `escapeParams()` now escapes both the list and the named values.

The fix also stops rewriting the named object that the caller passes. Before, the values of that object were replaced with their escaped form, so a second call with the same object escaped them twice.

v9 and v10 are no longer supported and will not be fixed. Please migrate to v11.

### Workarounds

- Do not pass list and named values in the same call when `escapeParameter` is enabled.
- Do not render translations that can contain untrusted values with `v-html`. Use component interpolation (`<i18n-t>`) instead.

## Affected packages

- `vue-i18n >= 9.0.0-beta.5, < 11.4.14`
- `vue-i18n >= 12.0.0-alpha.1, < 12.0.0-alpha.5`
- `@intlify/core >= 9.0.0-beta.10, < 11.4.14`
- `@intlify/core >= 12.0.0-alpha.1, < 12.0.0-alpha.5`
- `@intlify/core-base >= 9.0.0-beta.12, < 11.4.14`
- `@intlify/core-base >= 12.0.0-alpha.1, < 12.0.0-alpha.5`
- `petite-vue-i18n >= 9.2.0-alpha.7, < 11.4.14`
- `petite-vue-i18n >= 12.0.0-alpha.1, < 12.0.0-alpha.5`
- `@intlify/vue-i18n-core >= 9.2.0-alpha.7, < 11.4.14`
- `@intlify/vue-i18n-core >= 12.0.0-alpha.1, < 12.0.0-alpha.5`

## Remediation

Upgrade to a patched release:

- `vue-i18n 11.4.14`
- `vue-i18n 12.0.0-alpha.5`
- `@intlify/core 11.4.14`
- `@intlify/core 12.0.0-alpha.5`
- `@intlify/core-base 11.4.14`
- `@intlify/core-base 12.0.0-alpha.5`
- `petite-vue-i18n 11.4.14`
- `petite-vue-i18n 12.0.0-alpha.5`
- `@intlify/vue-i18n-core 11.4.14`
- `@intlify/vue-i18n-core 12.0.0-alpha.5`