{"id":"ghsa-ghsa-8rc2-428q-7ww3","seq":2056959,"kind":"advisory","title":"Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list","url":"https://github.com/advisories/GHSA-8rc2-428q-7ww3","permalink":"https://vulnpulse.app/items/ghsa-ghsa-8rc2-428q-7ww3","summary":"影響: npm:vue-i18n >= 9.0.0-beta.5, < 11.4.14 → 11.4.14, npm:vue-i18n >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:@intlify/core >= 9.0.0-beta.10, < 11.4.14 → 11.4.14, npm:@intlify/core >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:@intlify/core-base >= 9.0.0-beta.12, < 11.4.14 → 11.4.14, npm:@intlify/core-base >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:petite-vue-i18n >= 9.2.0-alpha.7, < 11.4.14 → 11.4.14, npm:petite-vue-i18n >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:@intlify/vue-i18n-core >= 9.2.0-alpha.7, < 11.4.14 → 11.4.14, npm:@intlify/vue-i18n-core >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5\nWhen escapeParameter is enabled (escapeParameterHtml in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. escapeParams() escapes either the list values or the named values, but not both: the two branches are joined by else. When a single call passes both, for example t(key, ['...'], { named: { ... } }), the named values reach the message without being escaped. Details escapeParams() in [packages/core-base/src/translate.ts (v11.4.13)](https://github.com/…","severity":"low","techs":["nodejs","vue","github"],"cves":["CVE-2026-118256"],"tags":["GHSA-8rc2-428q-7ww3","vue-i18n","vue-i18n","@intlify/core","@intlify/core","@intlify/core-base","@intlify/core-base","petite-vue-i18n","petite-vue-i18n","@intlify/vue-i18n-core","@intlify/vue-i18n-core"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:06:34.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}