p PatchFirst

CVE-2025-53892

CVE-2025-53892 · Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as <img src=x onerror=...>, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue.

CVSS 5.3 · Medium · EPSS 0.8% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • vue-i18n

    Versions
    • >= 9.0.0, < 9.14.5: Affected
    • >= 10.0.0, < 10.0.8: Affected
    • >= 11.0.0, < 11.1.0: Affected

    No fix published

  • vue-i18n npm

    Affected ranges
    • SEMVER: ≥ 9.0.0, < 9.14.5

    Update to 9.14.5

  • vue-i18n npm

    Affected ranges
    • SEMVER: ≥ 10.0.0, < 10.0.8

    Update to 10.0.8

  • vue-i18n npm

    Affected ranges
    • SEMVER: ≥ 11.0.0, < 11.1.10

    Update to 11.1.10

  • @intlify/core npm

    Affected ranges
    • SEMVER: ≥ 9.0.0, < 9.14.5

    Update to 9.14.5

  • @intlify/core npm

    Affected ranges
    • SEMVER: ≥ 10.0.0, < 10.0.8

    Update to 10.0.8

  • @intlify/core npm

    Affected ranges
    • SEMVER: ≥ 11.0.0, < 11.1.10

    Update to 11.1.10

  • @intlify/core-base npm

    Affected ranges
    • SEMVER: ≥ 9.0.0, < 9.14.5

    Update to 9.14.5

  • @intlify/core-base npm

    Affected ranges
    • SEMVER: ≥ 10.0.0, < 10.0.8

    Update to 10.0.8

  • @intlify/core-base npm

    Affected ranges
    • SEMVER: ≥ 11.0.0, < 11.1.10

    Update to 11.1.10

  • @intlify/vue-i18n-core npm

    Affected ranges
    • SEMVER: ≥ 9.2.0, < 9.14.5

    Update to 9.14.5

  • @intlify/vue-i18n-core npm

    Affected ranges
    • SEMVER: ≥ 10.0.0, < 10.0.8

    Update to 10.0.8

  • @intlify/vue-i18n-core npm

    Affected ranges
    • SEMVER: ≥ 11.0.0, < 11.1.10

    Update to 11.1.10

  • petite-vue-i18n npm

    Affected ranges
    • SEMVER: ≥ 10.0.0, < 10.0.8

    Update to 10.0.8

  • petite-vue-i18n npm

    Affected ranges
    • SEMVER: ≥ 11.0.0, < 11.1.10

    Update to 11.1.10

Original sources

Check your server →