Product
The Vue I18n sanitizer fails to neutralize the iframe srcdoc attribute when escapeParameter is enabled, allowing attackers to bypass protections and perform DOM-based XSS via injected HTML.