CVE-2026-118257High· 7.2▾ TwilightVue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.
vue-i18n = 9.14.5vue-i18n = 10.0.8vue-i18n >= 11.1.10, < 11.4.14vue-i18n >= 12.0.0-alpha.4, < 12.0.0-alpha.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
vue-i18n = 9.14.5vue-i18n = 10.0.8vue-i18n >= 11.1.10, < 11.4.14vue-i18n = 12.0.0-alpha.4petite-vue-i18n = 9.14.5petite-vue-i18n = 10.0.8petite-vue-i18n >= 11.1.10, < 11.4.14petite-vue-i18n = 12.0.0-alpha.4@intlify/core-base = 9.14.5@intlify/core-base = 10.0.8@intlify/core-base >= 11.1.10, < 11.4.14@intlify/core-base = 12.0.0-alpha.4@intlify/core = 9.14.5@intlify/core = 10.0.8@intlify/core >= 11.1.10, < 11.4.14@intlify/core = 12.0.0-alpha.4@intlify/vue-i18n-core = 9.14.5@intlify/vue-i18n-core = 10.0.8@intlify/vue-i18n-core >= 11.1.10, < 11.4.14@intlify/vue-i18n-core = 12.0.0-alpha.4@intlify/shared = 9.14.5@intlify/shared = 10.0.8@intlify/shared >= 11.1.10, < 11.4.14@intlify/shared = 12.0.0-alpha.4Patched in:
vue-i18n 11.4.14vue-i18n 12.0.0-alpha.5petite-vue-i18n 11.4.14petite-vue-i18n 12.0.0-alpha.5@intlify/core-base 11.4.14@intlify/core-base 12.0.0-alpha.5@intlify/core 11.4.14@intlify/core 12.0.0-alpha.5@intlify/vue-i18n-core 11.4.14@intlify/vue-i18n-core 12.0.0-alpha.5@intlify/shared 11.4.14@intlify/shared 12.0.0-alpha.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118256LowVue I18n: `escapeParameter` does not escape named values when the same call also passes a list
CVE-2026-116582Medium· 4.7Seroval: Script injection through RegExp sources in serialized output
CVE-2026-110725Low· 3.7fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
CVE-2026-106444Medium· 4.7Handlebars provides the power necessary to let users build semantic templates
CVE-2026-106107High· 8.3Quasar Framework is a framework for building high-performance Vue.js user interfaces
CVE-2026-106102Critical· 10.0Quasar Framework is a framework for building high-performance Vue.js user interfaces