DOM-Based XSS Vulnerability in Vue I18n Plugin by Intlify
CVE-2025-53892
What is CVE-2025-53892?
The Vue I18n internationalization plugin for Vue.js has a vulnerability stemming from its escapeParameterHtml: true option. This option is intended to uphold security by escaping interpolated parameters against HTML and script injections. However, from version 9.0.0 up until versions 9.14.4, 10.0.7, and 11.1.0, it does not adequately prevent execution of specific tag-based payloads—particularly when an interpolated value is placed in an HTML context with v-html usage. Consequently, this oversight can lead to DOM-based XSS vulnerabilities, exposing applications to potential attacks employing payloads like incorporated within translation strings. Users are advised to update to the fixed versions to mitigate this security risk.
Affected Version(s)
vue-i18n >= 9.0.0, < 9.14.5 < 9.0.0, 9.14.5
vue-i18n >= 10.0.0, < 10.0.8 < 10.0.0, 10.0.8
vue-i18n >= 11.0.0, < 11.1.0 < 11.0.0, 11.1.0