Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list
影響: npm:vue-i18n >= 9.0.0-beta.5, < 11.4.14 → 11.4.14, npm:vue-i18n >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:@intlify/core >= 9.0.0-beta.10, < 11.4.14 → 11.4.14, npm:@intlify/core >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:@intlify/core-base >= 9.0.0-beta.12, < 11.4.14 → 11.4.14, npm:@intlify/core-base >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:petite-vue-i18n >= 9.2.0-alpha.7, < 11.4.14 → 11.4.14, npm:petite-vue-i18n >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:@intlify/vue-i18n-core >= 9.2.0-alpha.7, < 11.4.14 → 11.4.14, npm:@intlify/vue-i18n-core >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5
When escapeParameter is enabled (escapeParameterHtml in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. escapeParams() escapes either the list values or the named values, but not both: the two branches are joined by else. When a single call passes both, for example t(key, ['...'], { named: { ... } }), the named values reach the message without being escaped. Details escapeParams() in [packages/core-base/src/translate.ts (v11.4.13)](https://github.com/…
| CVE | CVE-2026-118256 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 29. 오전 09:48 |
| 데이터 | Markdown JSON |
2026. 10. 29. 오전 06:06, GitHub Advisory Database에서 "Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "낮음"(low)입니다. 관련 기술: JavaScript / Node.js, Vue.js, GitHub. CVE: CVE-2026-118256.