Product

Vue-I18n (>= 11.1.10, < 11.4.14)

1 brief RSS

Vue I18n: srcdoc attribute XSS vulnerability (CVE-2026-118257)

The Vue I18n sanitizer fails to neutralize the iframe srcdoc attribute when escapeParameter is enabled, allowing attackers to bypass protections and perform DOM-based XSS via injected HTML.

vue-i18n +23 xss web-vulnerability client-side

1t 2c 53m ago