Vue-I18n (= 12.0.0-Alpha.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/vue-i18n--12.0.0-alpha.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 00:12:32 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgVue I18n: srcdoc attribute XSS vulnerability (CVE-2026-118257)https://feed.craftedsignal.io/briefs/2026-10-vue-i18n-xss/Thu, 29 Oct 2026 00:12:32 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-vue-i18n-xss/The Vue I18n sanitizer fails to neutralize the iframe srcdoc attribute when escapeParameter is enabled, allowing attackers to bypass protections and perform DOM-based XSS via injected HTML.Vue I18n's sanitizeTranslatedHtml() function, which is invoked when escapeParameter (or escapeParameterHtml in the Legacy API) is enabled, fails to properly secure the srcdoc attribute of <iframe> tags. Because browsers decode character references within the srcdoc attribute prior to parsing, the existing sanitization logic - which relies on escaping characters - is neutralized. This allows malicious markup injected via translation parameters or message strings to be parsed as a nested document within the application's origin, resulting in DOM-based XSS. This issue bypasses the fix for CVE-2025-53892.

Impact

Applications rendering translations using v-html are vulnerable if they display content that is not fully trusted, such as user-provided parameters, crowdsourced translations, or data affected by the separate issue tracked as GHSA-8rc2-428q-7ww3. Successful exploitation allows for the execution of arbitrary scripts in the context of the application's origin.

Recommendation

  • Upgrade vue-i18n to version 11.4.14, 12.0.0-alpha.5, or later.
  • If upgrading is not immediately possible, cease rendering translation messages that may contain untrusted content using v-html.
  • Prefer component interpolation using <i18n-t> instead of direct HTML rendering.
  • Sanitize or validate translation messages to remove srcdoc attributes from <iframe> elements if dynamic content must be rendered.
]]>highadvisoryxssweb-vulnerabilityclient-side