Go to packages list

intlify-core

Ecosystem: npm

Downloads:

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 2HighAffects 3 versions
  • 0MediumAffects 0 versions
  • 2ModerateAffects 5 versions
  • 1LowAffects 2 versions
Severity distribution (all time)
5vulnerabilities
  • Critical0 (0.0%)
  • High2 (40.0%)
  • Medium0 (0.0%)
  • Moderate2 (40.0%)
  • Low1 (20.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 2 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 1
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0

Vulnerabilities (5)

Known vulnerabilities affecting intlify-core, based on data from OSV.

Vulnerabilities affecting intlify-core
IDSeveritySummaryAffected versionsPublishedSource
GHSA-83rm-6c8r-g728HighVue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages### Summary When `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n passes the translated string through `sanitizeTranslatedHtml()`. The sanitizer escapes `<` and `>` in attribute values and neutralizes event handler attributes such as `onerror`, but it does not handle the `srcdoc` attribute of `<iframe>`. The value of `srcdoc` is an HTML document: the browser decodes the character references in it and parses the result as a nested document in the same origin. The escaping and the neutralization done by the sanitizer are both character references, so they are un
  • >= 11.1.10, < 11.4.14
  • >= 12.0.0-alpha.4, < 12.0.0-alpha.5
GitHub (opens in a new tab)
GHSA-8rc2-428q-7ww3LowVue I18n: `escapeParameter` does not escape named values when the same call also passes a list### Summary When `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. `escapeParams()` escapes either the list values or the named values, but not both: the two branches are joined by `else`. When a single call passes both, for example `t(key, ['...'], { named: { ... } })`, the named values reach the message without being escaped. ### Details `escapeParams()` in [`packages/core-base/src/translate.ts` (v11.4.13)](https://github.com/intlify/vue-i18n/blob/v11.4.13/packages/core-base/src/translate.ts):
  • >= 9.0.0-beta.10, < 11.4.14
  • >= 12.0.0-alpha.1, < 12.0.0-alpha.5
GitHub (opens in a new tab)
GHSA-x8qp-wqqm-57phModeratevue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes### Summary The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution of certain tag-based payloads, such as `<img src=x onerror=...>`, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. ### Details When escapeParameterHtml: true is enabled, it correctly escapes common injection
  • >= 9.0.0, < 9.14.5
  • >= 10.0.0, < 10.0.8
  • >= 11.0.0, < 11.1.10
GitHub (opens in a new tab)
GHSA-p2ph-7g93-hw3mHighVue I18n Allows Prototype Pollution in `handleFlatJson`**Vulnerability type:** Prototype Pollution **Vulnerability Location(s):** ```js # v9.1 node_modules/@intlify/message-resolver/index.js # v9.2 or later node_modules/@intlify/vue-i18n-core/index.js ``` **Description:** The latest version of `@intlify/message-resolver (9.1)` and `@intlify/vue-i18n-core (9.2 or later)`, (previous versions might also affected), is vulnerable to Prototype Pollution through the entry function(s) `handleFlatJson`. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of se
  • >= 9.1.0, < 9.1.11
GitHub (opens in a new tab)
GHSA-9r9m-ffp6-9x4vModeratevue-i18n has cross-site scripting vulnerability with prototype pollution### Vulnerability type XSS ### Description vue-i18n can be passed locale messages to `createI18n` or `useI18n`. we can then translate them using `t` and `$t`. vue-i18n has its own syntax for local messages, and uses a message compiler to generate AST. In order to maximize the performance of the translation function, vue-i18n uses bundler plugins such as `@intlify/unplugin-vue-i18n` and bulder to convert the AST in advance when building the application. By using that AST as the locale message, it is no longer necessary to compile, and it is possible to translate using the AST. The AST generat
  • >= 9.3.0, < 9.14.2
  • >= 10.0.0, < 10.0.5
GitHub (opens in a new tab)
  • GHSA-83rm-6c8r-g728High
    Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
    • >= 11.1.10, < 11.4.14
    • >= 12.0.0-alpha.4, < 12.0.0-alpha.5
    GitHub (opens in a new tab)

    ### Summary When `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n passes the translated string through `sanitizeTranslatedHtml()`. The sanitizer escapes `<` and `>` in attribute values and neutralizes event handler attributes such as `onerror`, but it does not handle the `srcdoc` attribute of `<iframe>`. The value of `srcdoc` is an HTML document: the browser decodes the character references in it and parses the result as a nested document in the same origin. The escaping and the neutralization done by the sanitizer are both character references, so they are un

    CVE: CVE-2026-118257

  • GHSA-8rc2-428q-7ww3Low
    Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list
    • >= 9.0.0-beta.10, < 11.4.14
    • >= 12.0.0-alpha.1, < 12.0.0-alpha.5
    GitHub (opens in a new tab)

    ### Summary When `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. `escapeParams()` escapes either the list values or the named values, but not both: the two branches are joined by `else`. When a single call passes both, for example `t(key, ['...'], { named: { ... } })`, the named values reach the message without being escaped. ### Details `escapeParams()` in [`packages/core-base/src/translate.ts` (v11.4.13)](https://github.com/intlify/vue-i18n/blob/v11.4.13/packages/core-base/src/translate.ts):

    CVE: CVE-2026-118256

  • GHSA-x8qp-wqqm-57phModerate
    vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes
    • >= 9.0.0, < 9.14.5
    • >= 10.0.0, < 10.0.8
    • +1 more
    GitHub (opens in a new tab)
    Affected versions:
    • >= 9.0.0, < 9.14.5
    • >= 10.0.0, < 10.0.8
    • >= 11.0.0, < 11.1.10

    ### Summary The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution of certain tag-based payloads, such as `<img src=x onerror=...>`, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. ### Details When escapeParameterHtml: true is enabled, it correctly escapes common injection

    CVE: CVE-2025-53892

  • GHSA-p2ph-7g93-hw3mHigh
    Vue I18n Allows Prototype Pollution in `handleFlatJson`
    • >= 9.1.0, < 9.1.11
    GitHub (opens in a new tab)

    **Vulnerability type:** Prototype Pollution **Vulnerability Location(s):** ```js # v9.1 node_modules/@intlify/message-resolver/index.js # v9.2 or later node_modules/@intlify/vue-i18n-core/index.js ``` **Description:** The latest version of `@intlify/message-resolver (9.1)` and `@intlify/vue-i18n-core (9.2 or later)`, (previous versions might also affected), is vulnerable to Prototype Pollution through the entry function(s) `handleFlatJson`. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of se

    CVE: CVE-2025-27597

  • GHSA-9r9m-ffp6-9x4vModerate
    vue-i18n has cross-site scripting vulnerability with prototype pollution
    • >= 9.3.0, < 9.14.2
    • >= 10.0.0, < 10.0.5
    GitHub (opens in a new tab)

    ### Vulnerability type XSS ### Description vue-i18n can be passed locale messages to `createI18n` or `useI18n`. we can then translate them using `t` and `$t`. vue-i18n has its own syntax for local messages, and uses a message compiler to generate AST. In order to maximize the performance of the translation function, vue-i18n uses bundler plugins such as `@intlify/unplugin-vue-i18n` and bulder to convert the AST in advance when building the application. By using that AST as the locale message, it is no longer necessary to compile, and it is possible to translate using the AST. The AST generat

    CVE: CVE-2024-52809

Showing 1-5 of 5 vulnerabilities