Vulnerability in Vue I18n Affects Vue.js Products
CVE-2026-118256
What is CVE-2026-118256?
The internationalization plugin for Vue.js, Vue I18n, is susceptible to an HTML injection vulnerability where enabling escapeParameter (escapeParameterHtml in the Legacy API) fails to sanitize named interpolation values when both list and named values are supplied. This occurs in situations where applications render translations as HTML without appropriate controls for untrusted input, potentially allowing attackers to inject malicious markup, including phishing links, forms, and layout modifications. Furthermore, when exploited alongside the srcdoc sanitizer bypass, this vulnerability may enable script execution on affected versions prior to the fixes implemented in versions 11.4.14 and 12.0.0-alpha.5.
Affected Version(s)
vue-i18n >= 9.0.0-beta.5, < 11.4.14 < 9.0.0-beta.5, 11.4.14
vue-i18n >= 12.0.0-alpha.1, < 12.0.0-alpha.5 < 12.0.0-alpha.1, 12.0.0-alpha.5