Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

影響: npm:vue-i18n >= 9.0.0-beta.5, < 11.4.14 → 11.4.14, npm:vue-i18n >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:@intlify/core >= 9.0.0-beta.10, < 11.4.14 → 11.4.14, npm:@intlify/core >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:@intlify/core-base >= 9.0.0-beta.12, < 11.4.14 → 11.4.14, npm:@intlify/core-base >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:petite-vue-i18n >= 9.2.0-alpha.7, < 11.4.14 → 11.4.14, npm:petite-vue-i18n >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:@intlify/vue-i18n-core >= 9.2.0-alpha.7, < 11.4.14 → 11.4.14, npm:@intlify/vue-i18n-core >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5

When escapeParameter is enabled (escapeParameterHtml in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. escapeParams() escapes either the list values or the named values, but not both: the two branches are joined by else. When a single call passes both, for example t(key, ['...'], { named: { ... } }), the named values reach the message without being escaped. Details escapeParams() in [packages/core-base/src/translate.ts (v11.4.13)](https://github.com/…

GitHub Advisory Databaseで読む

2026/10/29 06:06、GitHub Advisory Databaseが「Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「注意」(low) です。関連する技術: JavaScript / Node.js、Vue.js、GitHub。CVE: CVE-2026-118256。