Prototype Pollution Risk in Vue I18n Internationalization Plugin by Intlify

CVE-2025-27597

Summary

The Vue I18n plugin by Intlify is vulnerable to Prototype Pollution due to flaws in the handleFlatJson function of the @intlify/message-resolver and @intlify/vue-i18n-core components. An attacker can exploit this vulnerability by supplying a crafted payload that targets the Object.prototype setter, allowing them to manipulate properties within the global prototype chain. The implications of this vulnerability range from denial of service to potential injection-based attacks, particularly if the polluted properties intersect with sensitive Node.js APIs such as exec and eval, leading to unauthorized command execution within the application.

References