{"id":"CVE-2026-118257","summary":"Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages","details":"Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.","aliases":["GHSA-83rm-6c8r-g728"],"modified":"2026-10-29T02:48:26.866625308Z","published":"2026-10-28T18:23:49.400Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118257.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-116","CWE-79"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118257.json"},{"type":"FIX","url":"https://github.com/intlify/vue-i18n/commit/43391d20e7c85403cb59bdb21b5d542819f54042"},{"type":"FIX","url":"https://github.com/intlify/vue-i18n/pull/2679"},{"type":"WEB","url":"https://github.com/intlify/vue-i18n/releases/tag/v11.4.14"},{"type":"WEB","url":"https://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5"},{"type":"ADVISORY","url":"https://github.com/intlify/vue-i18n/security/advisories/GHSA-83rm-6c8r-g728"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118257"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/intlify/vue-i18n","events":[{"introduced":"ecbbd3a22361ce644a9185828cb4161daf528223"},{"fixed":"6bb9ebdeae4955cafb53e82bc461199f6186f573"},{"introduced":"dad48fc9e3761bd885117dd6c7dde1ebee8fdf91"},{"fixed":"2c2819246e15f3c8a018aa63887c9c31e3fe5455"},{"introduced":"924596094e3123251efb3b0ae2d93bbd4a5742ce"},{"last_affected":"30971026b77c5985a4ad3d56c665bf77c2536be7"},{"fixed":"43391d20e7c85403cb59bdb21b5d542819f54042"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"11.1.10"},{"fixed":"11.4.14"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"strategy":"StringRangeExpression","range":[{"introduced":"12.0.0-alpha.4"},{"fixed":"12.0.0-alpha.5"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"= 9.14.5"},{"last_affected":"= 9.14.5"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"= 10.0.8"},{"last_affected":"= 10.0.8"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"43391d20e7c85403cb59bdb21b5d542819f54042"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"v11.4.14","range":[{"fixed":"6bb9ebdeae4955cafb53e82bc461199f6186f573"}]},{"original_tag":"v12.0.0-alpha.5","range":[{"fixed":"2c2819246e15f3c8a018aa63887c9c31e3fe5455"}],"source":"REFERENCES_TAG"}]}}],"versions":["= 10.0.8","= 9.14.5","v11.4.13","v11.4.12","v11.4.10","v11.4.9","v11.4.8","v11.4.7","v11.4.6","v11.4.5","v11.4.4","v11.4.3","v12.0.0-alpha.4","v11.4.2","v11.4.1","v11.4.0","v11.3.2","v11.3.1","v11.3.0","v11.2.8","v11.2.7","v11.2.6","v11.2.5","v11.2.4","v11.2.3","v11.2.2","v11.2.1","v11.2.0","v11.1.12","v11.1.11","v11.1.10"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-118257.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}]}