Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
影響: npm:vue-i18n = 9.14.5, npm:vue-i18n = 10.0.8, npm:vue-i18n >= 11.1.10, < 11.4.14 → 11.4.14, npm:vue-i18n = 12.0.0-alpha.4 → 12.0.0-alpha.5, npm:petite-vue-i18n = 9.14.5, npm:petite-vue-i18n = 10.0.8, npm:petite-vue-i18n >= 11.1.10, < 11.4.14 → 11.4.14, npm:petite-vue-i18n = 12.0.0-alpha.4 → 12.0.0-alpha.5, npm:@intlify/core-base = 9.14.5, npm:@intlify/core-base = 10.0.8, npm:@intlify/core-base >= 11.1.10, < 11.4.14 → 11.4.14, npm:@intlify/core-base = 12.0.0-alpha.4 → 12.0.0-alpha.5, npm:@intlify/core = 9.14.5, npm:@intlify/core = 10.0.8, npm:@intlify/core >= 11.1.10, < 11.4.14 → 11.4.14, npm:@intlify/core = 12.0.0-alpha.4 → 12.0.0-alpha.5, npm:@intlify/vue-i18n-core = 9.14.5, npm:@intlify/vue-i18n-core = 10.0.8, npm:@intlify/vue-i18n-core >= 11.1.10, < 11.4.14 → 11.4.14, npm:@intlify/vue-i18n-core = 12.0.0-alpha.4 → 12.0.0-alpha.5, npm:@intlify/shared = 9.14.5, npm:@intlify/shared = 10.0.8, npm:@intlify/shared >= 11.1.10, < 11.4.14 → 11.4.14, npm:@intlify/shared = 12.0.0-alpha.4 → 12.0.0-alpha.5
When escapeParameter is enabled (escapeParameterHtml in the Legacy API), Vue I18n passes the translated string through sanitizeTranslatedHtml(). The sanitizer escapes in attribute values and neutralizes event handler attributes such as onerror, but it does not handle the srcdoc attribute of . The value of srcdoc is an HTML document: the browser decodes the character references in it and parses the result as a nested document in the same origin. The escaping and the neutralization done by the sa…
| CVE | CVE-2026-118257 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 29. 오전 09:48 |
| 데이터 | Markdown JSON |
2026. 10. 29. 오전 06:06, GitHub Advisory Database에서 "Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js, Vue.js. CVE: CVE-2026-118257.