CVE-2026-118257

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-118257
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-118257.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-118257
Aliases
Published
2026-10-28T18:23:49Z
Modified
2026-10-29T02:48:26Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
Details

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-116",
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118257.json"
}
References

Affected packages

Git / github.com/intlify/vue-i18n

Affected ranges

Type
GIT
Repo
https://github.com/intlify/vue-i18n
Events
Introduced
ecbbd3a22361ce644a9185828cb4161daf528223
Fixed
6bb9ebdeae4955cafb53e82bc461199f6186f573
Introduced
dad48fc9e3761bd885117dd6c7dde1ebee8fdf91
Fixed
2c2819246e15f3c8a018aa63887c9c31e3fe5455
Introduced
924596094e3123251efb3b0ae2d93bbd4a5742ce
Last Affected
30971026b77c5985a4ad3d56c665bf77c2536be7
Fixed
43391d20e7c85403cb59bdb21b5d542819f54042
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "11.1.10"
                },
                {
                    "fixed":  "11.4.14"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "12.0.0-alpha.4"
                },
                {
                    "fixed":  "12.0.0-alpha.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "= 9.14.5"
                },
                {
                    "last_affected":  "= 9.14.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "= 10.0.8"
                },
                {
                    "last_affected":  "= 10.0.8"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "fixed":  "43391d20e7c85403cb59bdb21b5d542819f54042"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v11.4.14",
            "range":  [
                {
                    "fixed":  "6bb9ebdeae4955cafb53e82bc461199f6186f573"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v12.0.0-alpha.5",
            "range":  [
                {
                    "fixed":  "2c2819246e15f3c8a018aa63887c9c31e3fe5455"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

= 10.*
= 10.0.8
= 9.*
= 9.14.5
v11.*
v11.1.10
v11.1.11
v11.1.12
v11.2.0
v11.2.1
v11.2.2
v11.2.3
v11.2.4
v11.2.5
v11.2.6
v11.2.7
v11.2.8
v11.3.0
v11.3.1
v11.3.2
v11.4.0
v11.4.1
v11.4.10
v11.4.12
v11.4.13
v11.4.2
v11.4.3
v11.4.4
v11.4.5
v11.4.6
v11.4.7
v11.4.8
v11.4.9
v12.*
v12.0.0-alpha.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-118257.json"