CVE-2026-118257

High · 7.2

CVSS

7.2

EPSS

0.3%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A translation tool used in websites has a flaw that could let attackers run unwanted code on pages when certain options are active, so update it promptly to stay protected.

Exploitation: Remote Unauthenticated
Attacker needs: None
Complexity: Low
Impact: Data Tampering
Component: Library
Class: XSS
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

The flaw bypasses sanitization in sanitizeTranslatedHtml() by leaving the srcdoc attribute of iframes active, allowing browser decoding of character references to execute attacker-controlled scripts as same-origin content when escapeParameter is enabled and translations render via v-html.

Why it matters to the business

Web applications relying on this internationalization plugin face immediate risk of script execution leading to data exposure or unauthorized actions, requiring urgent patching as the issue was disclosed only one day ago with no known mitigations in affected releases.

How an attack unfolds

An attacker supplies malicious translation strings containing an iframe srcdoc payload with encoded scripts. When the application enables escapeParameter and renders content through v-html, the incomplete sanitization allows the browser to parse and execute the scripts in the application's origin.

How to fix it

Upgrade to Vue I18n 11.4.14 or 12.0.0-alpha.5. Migrate from unsupported versions 9.14.5 and 10.0.8 to a maintained release. Disable escapeParameter where possible until updates are applied.

How to confirm the fix worked

Confirm the installed package version meets or exceeds 11.4.14 or 12.0.0-alpha.5, then test sanitizeTranslatedHtml with srcdoc payloads to ensure scripts no longer execute.

Typical attack path

Locate web applications using vulnerable Vue I18n versions with escapeParameter enabled
Craft translation content embedding an iframe srcdoc attribute with encoded script
Deliver the malicious translations via user input or external sources
Trigger v-html rendering of the translation to execute the payload

How to detect it

Search web server and application logs for unusual iframe srcdoc attributes or script tags appearing in translation outputs, and monitor calls to sanitizeTranslatedHtml involving parameter escaping.

sanitizeTranslatedHtml
srcdoc=
escapeParameter
v-html

What your security team should do

Immediately upgrade all Vue I18n instances to the fixed versions
Audit code for escapeParameter usage combined with v-html rendering of translations
Review web logs for unexpected script execution or srcdoc patterns
Temporarily disable vulnerable rendering options if patching is delayed

The record

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Affected packages

Ecosystem	Package	Introduced	Fixed