CVE-2026-118257 in vue-i18n
Summary
by MITRE • 10/28/2026
Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within Vue I18n represents a significant cross-site scripting risk stemming from improper sanitization of HTML content rendered via the srcdoc attribute in iframe elements. This flaw affects specific versions of the internationalization plugin for Vue.js, namely those ranging from 11.1.10 to 11.4.13 and from 12.0.0-alpha.4 to 12.0.0-alpha.5, with legacy unsupported versions such as 9.14.5 and 10.0.8 also being susceptible. The core technical issue lies in the sanitizeTranslatedHtml function which attempts to mitigate script injection by escaping markup and event-handler text within an iframe srcdoc value. However, this sanitization process is incomplete because it leaves the srcdoc attribute itself active rather than neutralizing or removing it entirely when unsafe content is detected. Consequently, while specific dangerous tags might be escaped, the browser continues to interpret the srcdoc attribute as a valid source for nested HTML content.
When an application utilizes Vue I18n with escapeParameter enabled and renders translations using v-html, attacker-controlled parameters or malicious translation strings can bypass these partial sanitization measures. The browser decodes character references present in the sanitized output and parses the resulting string as a same-origin nested HTML document due to the active srcdoc attribute. This parsing behavior allows embedded script elements that were not fully neutralized by the sanitizer to execute within the context of the parent page's origin. Because the iframe is treated as same-origin, any executed scripts have full access to cookies, local storage, and other sensitive data associated with the host domain, effectively elevating a stored or reflected cross-site scripting vulnerability into one that can lead to complete session hijacking or account takeover.
This flaw aligns closely with CWE-79, which classifies improper neutralization of input during web page generation known as Cross-site Scripting. Furthermore, from an offensive security perspective, this behavior maps to the MITRE ATT&CK technique T1059.004, specifically JavaScript execution within a browser environment. The vulnerability exploits the trust relationship between the application and its internationalized content, assuming that escaped markup is sufficient protection without considering how browsers handle attribute-based HTML injection vectors like srcdoc. It is important to note that this specific attack vector does not affect i18n-t rendering components, indicating that the flaw is isolated to certain rendering methods within the library's architecture.
To mitigate this vulnerability, developers must upgrade Vue I18n to version 11.4.14 or later for the stable branch and version 12.0.0-alpha.5 or higher for the alpha releases where these fixes are implemented. For organizations still relying on unsupported versions such as 9.14.5 or 10.0.8, immediate migration to a supported release is critical as no patches will be issued for those legacy branches. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts and iframes are allowed to load, thereby limiting the impact even if similar vulnerabilities exist in other dependencies. Regular auditing of third-party libraries used for internationalization is essential to ensure that sanitization logic remains robust against evolving browser parsing behaviors and attack techniques.