@intlify/core-base vulnerabilities
CVEs whose affected-version data names the @intlify/core-base package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-118257High· 7.2Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
▾ Twilightvue-i18n · vue-i18nvia GHSA
CVE-2026-118256LowVue I18n: `escapeParameter` does not escape named values when the same call also passes a list
Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list
▾ Sunlitvue-i18n · vue-i18nvia GHSA