{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/petite-vue-i18n--10.0.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2025-53892"},{"cvss":7.2,"id":"CVE-2026-118257"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["vue-i18n (\u003e= 11.1.10, \u003c 11.4.14)","vue-i18n (= 9.14.5)","vue-i18n (= 10.0.8)","vue-i18n (= 12.0.0-alpha.4)","petite-vue-i18n (\u003e= 11.1.10, \u003c 11.4.14)","petite-vue-i18n (= 9.14.5)","petite-vue-i18n (= 10.0.8)","petite-vue-i18n (= 12.0.0-alpha.4)","@intlify/core-base (\u003e= 11.1.10, \u003c 11.4.14)","@intlify/core-base (= 9.14.5)","@intlify/core-base (= 10.0.8)","@intlify/core-base (= 12.0.0-alpha.4)","@intlify/core (\u003e= 11.1.10, \u003c 11.4.14)","@intlify/core (= 9.14.5)","@intlify/core (= 10.0.8)","@intlify/core (= 12.0.0-alpha.4)","@intlify/vue-i18n-core (\u003e= 11.1.10, \u003c 11.4.14)","@intlify/vue-i18n-core (= 9.14.5)","@intlify/vue-i18n-core (= 10.0.8)","@intlify/vue-i18n-core (= 12.0.0-alpha.4)","@intlify/shared (\u003e= 11.1.10, \u003c 11.4.14)","@intlify/shared (= 9.14.5)","@intlify/shared (= 10.0.8)","@intlify/shared (= 12.0.0-alpha.4)"],"_cs_severities":["high"],"_cs_tags":["xss","web-vulnerability","client-side"],"_cs_type":"advisory","_cs_vendors":["Intlify"],"content_html":"\u003cp\u003eVue I18n's \u003ccode\u003esanitizeTranslatedHtml()\u003c/code\u003e function, which is invoked when \u003ccode\u003eescapeParameter\u003c/code\u003e (or \u003ccode\u003eescapeParameterHtml\u003c/code\u003e in the Legacy API) is enabled, fails to properly secure the \u003ccode\u003esrcdoc\u003c/code\u003e attribute of \u003ccode\u003e\u0026lt;iframe\u0026gt;\u003c/code\u003e tags. Because browsers decode character references within the \u003ccode\u003esrcdoc\u003c/code\u003e attribute prior to parsing, the existing sanitization logic - which relies on escaping characters - is neutralized. This allows malicious markup injected via translation parameters or message strings to be parsed as a nested document within the application's origin, resulting in DOM-based XSS. This issue bypasses the fix for CVE-2025-53892.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eApplications rendering translations using \u003ccode\u003ev-html\u003c/code\u003e are vulnerable if they display content that is not fully trusted, such as user-provided parameters, crowdsourced translations, or data affected by the separate issue tracked as GHSA-8rc2-428q-7ww3. Successful exploitation allows for the execution of arbitrary scripts in the context of the application's origin.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003evue-i18n\u003c/code\u003e to version 11.4.14, 12.0.0-alpha.5, or later.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, cease rendering translation messages that may contain untrusted content using \u003ccode\u003ev-html\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003ePrefer component interpolation using \u003ccode\u003e\u0026lt;i18n-t\u0026gt;\u003c/code\u003e instead of direct HTML rendering.\u003c/li\u003e\n\u003cli\u003eSanitize or validate translation messages to remove \u003ccode\u003esrcdoc\u003c/code\u003e attributes from \u003ccode\u003e\u0026lt;iframe\u0026gt;\u003c/code\u003e elements if dynamic content must be rendered.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T00:12:32Z","date_published":"2026-10-29T00:12:32Z","id":"https://feed.craftedsignal.io/briefs/2026-10-vue-i18n-xss/","summary":"The Vue I18n sanitizer fails to neutralize the iframe srcdoc attribute when escapeParameter is enabled, allowing attackers to bypass protections and perform DOM-based XSS via injected HTML.","title":"Vue I18n: srcdoc attribute XSS vulnerability (CVE-2026-118257)","url":"https://feed.craftedsignal.io/briefs/2026-10-vue-i18n-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Petite-Vue-I18n (= 10.0.8)","version":"https://jsonfeed.org/version/1.1"}