CVE-2025-27597

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-27597
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27597.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-27597
Aliases
Published
2025-03-07T15:51:39.753Z
Modified
2026-04-10T05:24:10.640450Z
Severity
  • 8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Vue I18n Prototype Pollution in `handleFlatJson`
Details

Vue I18n is the internationalization plugin for Vue.js. @intlify/message-resolver and @intlify/vue-i18n-core are vulnerable to Prototype Pollution through the entry function: handleFlatJson. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence. Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1321"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27597.json"
}
References

Affected packages

Git / github.com/intlify/vue-i18n

Affected ranges

Type
GIT
Repo
https://github.com/intlify/vue-i18n
Events
Introduced
99428093a755cb711d77372ca6b0900d9b69154d
Fixed
2e255c59ded7caf7c35f67190a336ce4cec82816
Database specific 
{
    "versions": [
        {
            "introduced": "9.1.0"
        },
        {
            "fixed": "9.14.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/intlify/vue-i18n
Events
Introduced
340890d084cd9f3f0110891eb92d90c7855a8baf
Fixed
e40c1601656d7e517fb1a3a84f55bd536a847ffb
Database specific 
{
    "versions": [
        {
            "introduced": "10.0.0-alpha.1"
        },
        {
            "fixed": "10.0.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/intlify/vue-i18n
Events
Introduced
2a44e212bba79f4b1568b1ac5abaa5bce9e2d3a1
Fixed
28ccc4cd85a5153927916891c9e7a4db1d3d2bdd
Database specific 
{
    "versions": [
        {
            "introduced": "11.0.0-beta.0"
        },
        {
            "fixed": "11.1.2"
        }
    ]
}

Affected versions

v10.*
v10.0.0
v10.0.0-alpha.1
v10.0.0-alpha.2
v10.0.0-alpha.3
v10.0.0-alpha.4
v10.0.0-alpha.5
v10.0.0-beta.1
v10.0.0-beta.2
v10.0.0-beta.3
v10.0.0-beta.4
v10.0.0-beta.5
v10.0.0-beta.6
v10.0.0-rc.1
v10.0.1
v10.0.2
v10.0.3
v10.0.4
v10.0.5
v11.*
v11.0.0
v11.0.0-beta.0
v11.0.0-beta.1
v11.0.0-beta.2
v11.0.0-rc.1
v11.0.1
v11.1.0
v11.1.1
v9.*
v9.1.0
v9.1.1
v9.1.2
v9.1.3
v9.1.4
v9.1.5
v9.1.6
v9.10.0
v9.10.1
v9.10.2
v9.11.0
v9.11.1
v9.12.0
v9.12.1
v9.13.0
v9.13.1
v9.14.0
v9.14.1
v9.14.2
v9.2.0
v9.2.0-alpha.1
v9.2.0-alpha.2
v9.2.0-alpha.3
v9.2.0-alpha.4
v9.2.0-alpha.5
v9.2.0-alpha.6
v9.2.0-alpha.7
v9.2.0-alpha.8
v9.2.0-alpha.9
v9.2.0-beta.1
v9.2.0-beta.10
v9.2.0-beta.11
v9.2.0-beta.12
v9.2.0-beta.13
v9.2.0-beta.14
v9.2.0-beta.15
v9.2.0-beta.16
v9.2.0-beta.17
v9.2.0-beta.18
v9.2.0-beta.19
v9.2.0-beta.2
v9.2.0-beta.20
v9.2.0-beta.21
v9.2.0-beta.22
v9.2.0-beta.23
v9.2.0-beta.24
v9.2.0-beta.25
v9.2.0-beta.26
v9.2.0-beta.27
v9.2.0-beta.28
v9.2.0-beta.29
v9.2.0-beta.3
v9.2.0-beta.30
v9.2.0-beta.31
v9.2.0-beta.32
v9.2.0-beta.33
v9.2.0-beta.34
v9.2.0-beta.35
v9.2.0-beta.36
v9.2.0-beta.37
v9.2.0-beta.38
v9.2.0-beta.39
v9.2.0-beta.4
v9.2.0-beta.40
v9.2.0-beta.5
v9.2.0-beta.6
v9.2.0-beta.7
v9.2.0-beta.8
v9.2.0-beta.9
v9.2.1
v9.2.2
v9.3.0
v9.3.0-beta.0
v9.3.0-beta.1
v9.3.0-beta.10
v9.3.0-beta.11
v9.3.0-beta.12
v9.3.0-beta.13
v9.3.0-beta.14
v9.3.0-beta.15
v9.3.0-beta.16
v9.3.0-beta.17
v9.3.0-beta.18
v9.3.0-beta.19
v9.3.0-beta.2
v9.3.0-beta.20
v9.3.0-beta.21
v9.3.0-beta.22
v9.3.0-beta.23
v9.3.0-beta.24
v9.3.0-beta.25
v9.3.0-beta.26
v9.3.0-beta.27
v9.3.0-beta.3
v9.3.0-beta.4
v9.3.0-beta.5
v9.3.0-beta.6
v9.3.0-beta.7
v9.3.0-beta.8
v9.3.0-beta.9
v9.4.0
v9.4.1
v9.5.0
v9.6.0
v9.6.1
v9.6.2
v9.6.3
v9.6.4
v9.6.5
v9.7.0
v9.7.1
v9.8.0
v9.9.0
v9.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27597.json"