CVE-2026-118256 in Vue I18n
Summary
by MITRE • 10/28/2026
Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
Vue I18n serves as a critical internationalization plugin for Vue.js, facilitating the management of localized strings within web applications. A significant security vulnerability exists within this library in versions ranging from 9.0.0-beta.5 through 11.4.14 and up to 12.0.0-alpha.5. The core issue stems from a flaw in how the escapeParameter feature, known as escapeParameterHtml in the Legacy API, handles parameter escaping during translation rendering. Specifically, when an application enables this security feature but supplies both list-style and named interpolation values within the same translation call, the library fails to properly sanitize the named parameters. This behavior arises because the internal escapeParams function is designed to process only the branch associated with list-based arguments, leaving the named parameter branch unescaped despite the global safety setting being active.
The technical root of this vulnerability lies in a logic gap within the interpolation processing pipeline. When developers utilize mixed argument styles for translations, expecting comprehensive protection against cross-site scripting attacks, the library inadvertently bypasses sanitization for any values passed via object-based named parameters. This creates a direct path for attacker-controlled content to be injected into the rendered HTML output without proper encoding or escaping mechanisms being applied. The flaw is particularly dangerous because it undermines the developer's reliance on built-in security features, leading to a false sense of safety regarding input handling in internationalized applications.
The operational impact of this vulnerability is severe, primarily manifesting as Stored Cross-Site Scripting and Reflected Cross-Site Scripting depending on how the vulnerable translation strings are sourced. Attackers can exploit this flaw by injecting malicious HTML markup into named interpolation values that are subsequently rendered without sanitization. This capability allows for a wide range of attacks including phishing campaigns through injected login forms or deceptive links, layout manipulation to disrupt user experience and trust, and direct script execution if combined with other browser-specific bypasses such as srcdoc sanitizer vulnerabilities. In environments where the HTML sanitizer is disabled or ineffective, this vulnerability becomes an immediate vector for arbitrary code execution within the context of the victim's session.
This issue aligns with CWE-79, which classifies improper neutralization of input during web page generation known as Cross-site Scripting. From a tactical perspective, it maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter when script execution is achieved, or T1189 Drive-by Compromise if the attack vector involves malicious content delivered via compromised translations. The vulnerability highlights the importance of consistent input validation across all code paths in security-critical libraries, ensuring that no branch of logic can bypass established sanitization protocols regardless of argument format.
To mitigate this risk, organizations must immediately upgrade Vue I18n to version 11.4.14 or later for stable releases and version 12.0.0-alpha.5 or later for alpha releases where the fix has been implemented. Developers should also audit existing codebases that utilize mixed list and named interpolation arguments in translation calls, ensuring they are updated to use only one consistent argument style until migration is complete. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting script execution sources, thereby reducing the impact even if a successful injection attempt occurs through this specific library flaw.