Script Execution Vulnerability in Vue I18n Plugin from Intlify
CVE-2026-118257
7.2HIGH
What is CVE-2026-118257?
A vulnerability in the Vue I18n internationalization plugin enables attackers to execute scripts through the srcdoc attribute in iframes. When applications utilize escapeParameter to render translations as HTML via v-html, any attacker-provided parameters or content placed in srcdoc can be executed. This flaw was identified in versions 11.1.10 to 11.4.14 and 12.0.0-alpha.4 to 12.0.0-alpha.5, as well as in older unsupported versions 9.14.5 and 10.0.8. This vulnerability was addressed in versions 11.4.14 and 12.0.0-alpha.5.
Affected Version(s)
vue-i18n = 9.14.5 = 9.14.5
vue-i18n = 10.0.8 = 10.0.8
vue-i18n >= 11.1.10, < 11.4.14 < 11.1.10, 11.4.14