Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

影響: npm:vue-i18n >= 9.0.0-beta.5, < 11.4.14 → 11.4.14, npm:vue-i18n >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:@intlify/core >= 9.0.0-beta.10, < 11.4.14 → 11.4.14, npm:@intlify/core >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:@intlify/core-base >= 9.0.0-beta.12, < 11.4.14 → 11.4.14, npm:@intlify/core-base >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:petite-vue-i18n >= 9.2.0-alpha.7, < 11.4.14 → 11.4.14, npm:petite-vue-i18n >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5, npm:@intlify/vue-i18n-core >= 9.2.0-alpha.7, < 11.4.14 → 11.4.14, npm:@intlify/vue-i18n-core >= 12.0.0-alpha.1, < 12.0.0-alpha.5 → 12.0.0-alpha.5

When escapeParameter is enabled (escapeParameterHtml in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. escapeParams() escapes either the list values or the named values, but not both: the two branches are joined by else. When a single call passes both, for example t(key, ['...'], { named: { ... } }), the named values reach the message without being escaped. Details escapeParams() in [packages/core-base/src/translate.ts (v11.4.13)](https://github.com/…

在 GitHub Advisory Database 阅读

2026/10/29 06:06，GitHub Advisory Database 发布了“Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list”（类型：漏洞公告）。严重程度为“低危”（low）。相关技术：JavaScript / Node.js、Vue.js、GitHub。CVE：CVE-2026-118256。