Vue I18n: srcdoc attribute XSS vulnerability (CVE-2026-118257)
The Vue I18n sanitizer fails to neutralize the iframe srcdoc attribute when escapeParameter is enabled, allowing attackers to bypass protections and perform DOM-based XSS via injected HTML.
CVE search metadata
CVE search record: CVE-2025-53892. EPSS: 0.81%. KEV: no. Product: vue-i18n (>= 11.1.10, < 11.4.14), vue-i18n (= 9.14.5), vue-i18n (= 10.0.8), vue-i18n (= 12.0.0-alpha.4), petite-vue-i18n (>= 11.1.10, < 11.4.14), petite-vue-i18n (= 9.14.5), petite-vue-i18n (= 10.0.8), petite-vue-i18n (= 12.0.0-alpha.4), @intlify/core-base (>= 11.1.10, < 11.4.14), @intlify/core-base (= 9.14.5), @intlify/core-base (= 10.0.8), @intlify/core-base (= 12.0.0-alpha.4), @intlify/core (>= 11.1.10, < 11.4.14), @intlify/core (= 9.14.5), @intlify/core (= 10.0.8), @intlify/core (= 12.0.0-alpha.4), @intlify/vue-i18n-core (>= 11.1.10, < 11.4.14), @intlify/vue-i18n-core (= 9.14.5), @intlify/vue-i18n-core (= 10.0.8), @intlify/vue-i18n-core (= 12.0.0-alpha.4), @intlify/shared (>= 11.1.10, < 11.4.14), @intlify/shared (= 9.14.5), @intlify/shared (= 10.0.8), @intlify/shared (= 12.0.0-alpha.4). Brief: Vue I18n: srcdoc attribute XSS vulnerability (CVE-2026-118257). Brief link: https://feed.craftedsignal.io/briefs/2026-10-vue-i18n-xss/
CVE search record: CVE-2026-118257. Severity: high. CVSS: 7.2. KEV: no. Product: vue-i18n (>= 11.1.10, < 11.4.14), vue-i18n (= 9.14.5), vue-i18n (= 10.0.8), vue-i18n (= 12.0.0-alpha.4), petite-vue-i18n (>= 11.1.10, < 11.4.14), petite-vue-i18n (= 9.14.5), petite-vue-i18n (= 10.0.8), petite-vue-i18n (= 12.0.0-alpha.4), @intlify/core-base (>= 11.1.10, < 11.4.14), @intlify/core-base (= 9.14.5), @intlify/core-base (= 10.0.8), @intlify/core-base (= 12.0.0-alpha.4), @intlify/core (>= 11.1.10, < 11.4.14), @intlify/core (= 9.14.5), @intlify/core (= 10.0.8), @intlify/core (= 12.0.0-alpha.4), @intlify/vue-i18n-core (>= 11.1.10, < 11.4.14), @intlify/vue-i18n-core (= 9.14.5), @intlify/vue-i18n-core (= 10.0.8), @intlify/vue-i18n-core (= 12.0.0-alpha.4), @intlify/shared (>= 11.1.10, < 11.4.14), @intlify/shared (= 9.14.5), @intlify/shared (= 10.0.8), @intlify/shared (= 12.0.0-alpha.4). Brief: Vue I18n: srcdoc attribute XSS vulnerability (CVE-2026-118257). Brief link: https://feed.craftedsignal.io/briefs/2026-10-vue-i18n-xss/
Triage facts
Revision 1- Applicability
- vue-i18n (>= 11.1.10, < 11.4.14), vue-i18n (= 9.14.5) +22
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 29, 00:12 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A1Likely
Vue I18n's sanitizeTranslatedHtml() function, which is invoked when escapeParameter (or escapeParameterHtml in the Legacy API) is enabled, fails to properly secure the srcdoc attribute of <iframe> tags. Because browsers decode character references within the srcdoc attribute prior to parsing, the existing sanitization logic - which relies on escaping characters - is neutralized. This allows malicious markup injected via translation parameters or message strings to be parsed as a nested document within the application's origin, resulting in DOM-based XSS. This issue bypasses the fix for CVE-2025-53892.
Impact
Applications rendering translations using v-html are vulnerable if they display content that is not fully trusted, such as user-provided parameters, crowdsourced translations, or data affected by the separate issue tracked as GHSA-8rc2-428q-7ww3. Successful exploitation allows for the execution of arbitrary scripts in the context of the application's origin.
Recommendation
- Upgrade
vue-i18nto version 11.4.14, 12.0.0-alpha.5, or later. - If upgrading is not immediately possible, cease rendering translation messages that may contain untrusted content using
v-html. - Prefer component interpolation using
<i18n-t>instead of direct HTML rendering. - Sanitize or validate translation messages to remove
srcdocattributes from<iframe>elements if dynamic content must be rendered.
Immediate actions
Identify and patch all applications using vulnerable versions of vue-i18n to 11.4.14 or later
Threat Hunt
Identify application codebases utilizing v-html to render translations from the vue-i18n library
Data: Source code search for "v-html" and "t(" or "$t("
Mitigations
Replace v-html rendering of potentially untrusted translation messages with component interpolation (<i18n-t>)
CVE-2026-118257