Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

影響: npm:vue-i18n >= 9.0.0-beta.5, < 11.4.14 → 11.4.14, npm:vue-i18n >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:@intlify/core >= 9.0.0-beta.10, < 11.4.14 → 11.4.14, npm:@intlify/core >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:@intlify/core-base >= 9.0.0-beta.12, < 11.4.14 → 11.4.14, npm:@intlify/core-base >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:petite-vue-i18n >= 9.2.0-alpha.7, < 11.4.14 → 11.4.14, npm:petite-vue-i18n >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:@intlify/vue-i18n-core >= 9.2.0-alpha.7, < 11.4.14 → 11.4.14, npm:@intlify/vue-i18n-core >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5

When escapeParameter is enabled (escapeParameterHtml in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. escapeParams() escapes either the list values or the named values, but not both: the two branches are joined by else. When a single call passes both, for example t(key, ['...'], { named: { ... } }), the named values reach the message without being escaped. Details escapeParams() in [packages/core-base/src/translate.ts (v11.4.13)](https://github.com/…

Read on GitHub Advisory Database

On 10/29/2026, 06:06 AM, GitHub Advisory Database published "Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list" (type: Advisory). Severity is "Low" (low). Related technologies: JavaScript / Node.js, Vue.js, GitHub. CVE: CVE-2026-118256.