CVE-2026-118256

What it actually does

The escapeParams() function only processes the list interpolation branch and skips named values when both are supplied in the same translation call, allowing attacker-controlled markup to reach HTML rendering contexts even when escapeParameter is enabled.

Why it matters to the business

Applications that display user-supplied translations as HTML may expose users to phishing, form injection, or layout tampering; remediation urgency is elevated because the flaw affects widely used internationalization libraries with high downstream adoption.

How an attack unfolds

An attacker supplies a translation string containing both list and named placeholders, sets escapeParameter to true, and injects untrusted content into the named value; the library renders the named value without escaping, permitting markup insertion that can lead to script execution when combined with other sanitizer weaknesses.

How to fix it

Upgrade Vue I18n to 11.4.14 or 12.0.0-alpha.5 (or later) for all affected branches; until upgrades are complete, avoid mixing list and named parameters in the same translation call when escapeParameter is active and sanitize named values manually before passing them to the library.

How to confirm the fix worked

After patching, confirm the fixed version string appears in package metadata or lockfiles; test by supplying mixed list and named parameters with escapeParameter enabled and verify that named values are HTML-escaped in the output.

Typical attack path

1. Identify an application endpoint that renders i18n translations containing both list and named parameters with escapeParameter enabled.
2. Craft a malicious translation payload that places untrusted input in a named parameter while also supplying a list parameter.
3. Submit the payload via user-controlled translation data or message catalog.
4. Observe unsanitized HTML markup reflected in the rendered output.
5. Escalate to phishing links, credential forms, or script execution if additional bypasses exist.

How to detect it

Search application logs and rendered page sources for translation calls that include both array-style and object-style parameters in the same invocation; inspect network responses or DOM snapshots for unexpected HTML tags or attributes originating from named interpolation values.

What your security team should do

• Prioritize upgrade of Vue I18n to 11.4.14 or 12.0.0-alpha.5 across all applications within the next sprint.
• Audit codebases for translation calls that combine list and named parameters while escapeParameter is enabled.
• Add automated dependency scanning rules to block future vulnerable versions of the library.
• Review HTML rendering paths that consume i18n output for additional output encoding controls.