{"id":"CVE-2026-118256","kind":"vulnerability","aliases":["CVE-2026-118256","GHSA-8rc2-428q-7ww3"],"related":[],"title":"Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list","description":"### Summary\n\nWhen `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. `escapeParams()` escapes either the list values or the named values, but not both: the two branches are joined by `else`. When a single call passes both, for example `t(key, ['...'], { named: { ... } })`, the named values reach the message without being escaped.\n\n### Details\n\n`escapeParams()` in [`packages/core-base/src/translate.ts` (v11.4.13)](https://github.com/intlify/vue-i18n/blob/v11.4.13/packages/core-base/src/translate.ts):\n\n```ts\nfunction escapeParams(options: TranslateOptions) {\n  if (isArray(options.list)) {\n    options.list = options.list.map(item => (isString(item) ? escapeHtml(item) : item))\n  } else if (isObject(options.named)) {\n    // ...escapes the named values\n  }\n}\n```\n\n`t(key, list, options)` is a public overload, and `TranslateOptions` has a `named` field, so a call can carry both. The list is checked first, and the named values are then left as they are.\n\nThe translated string still goes through `sanitizeTranslatedHtml()` (added for CVE-2025-53892), which neutralizes event handler attributes and `javascript:` URLs. Other markup in the named values, such as links and forms, is inserted as is. Before the fix for GHSA-83rm-6c8r-g728, an `<iframe srcdoc>` in a named value also passes the sanitizer, and script runs. Versions without the sanitizer (before 9.14.5, 10.0.8 and 11.1.10, and 12.0.0-alpha.1 to alpha.3) insert the named values as HTML without any further check.\n\n`<i18n-t>` is not affected: it passes either list or named values, never both, and it does not render translations as HTML.\n\n### PoC\n\n```js\nimport { createI18n } from 'vue-i18n'\n\nconst i18n = createI18n({\n  legacy: false,\n  locale: 'en',\n  escapeParameter: true,\n  messages: {\n    en: { withList: '{0} {name}', withoutList: '{name}' }\n  }\n})\nconst t = i18n.global.t\n\nt('withoutList', { name: '<b>x</b>' })\n// &lt;b&gt;x&lt;&#x2F;b&gt;      escaped\n\nt('withList', ['a'], { named: { name: '<b>x</b>' } })\n// a <b>x</b>                   not escaped (v11.4.13)\n```\n\n### Impact\n\nApplications are affected when they enable `escapeParameter`, render translations as HTML (for example with `v-html`), and pass untrusted named values in the same call as a list. The named values are inserted as markup: phishing links, forms, or layout changes. Together with GHSA-83rm-6c8r-g728, or on versions without the sanitizer, this leads to script execution (DOM-based XSS).\n\n### Patches\n\nFixed in 11.4.14 and 12.0.0-alpha.5. `escapeParams()` now escapes both the list and the named values.\n\nThe fix also stops rewriting the named object that the caller passes. Before, the values of that object were replaced with their escaped form, so a second call with the same object escaped them twice.\n\nv9 and v10 are no longer supported and will not be fixed. Please migrate to v11.\n\n### Workarounds\n\n- Do not pass list and named values in the same call when `escapeParameter` is enabled.\n- Do not render translations that can contain untrusted values with `v-html`. Use component interpolation (`<i18n-t>`) instead.","summary":"When escapeParameter is enabled and a translation call passes both list and named values, named values are not HTML-escaped, so untrusted named values can inject markup into translations rendered as HTML. The sources say this can enable phishing links, forms and script execution when combined with a sanitizer bypass or on releases without the sanitizer.","severity":"low","cvss":2.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vue-i18n","fixed":["11.4.14"],"affected":">= 9.0.0-beta.5, < 11.4.14","ecosystem":"npm"},{"name":"vue-i18n","fixed":["12.0.0-alpha.5"],"affected":">= 12.0.0-alpha.1, < 12.0.0-alpha.5","ecosystem":"npm"},{"name":"@intlify/core","fixed":["11.4.14"],"affected":">= 9.0.0-beta.10, < 11.4.14","ecosystem":"npm"},{"name":"@intlify/core","fixed":["12.0.0-alpha.5"],"affected":">= 12.0.0-alpha.1, < 12.0.0-alpha.5","ecosystem":"npm"},{"name":"@intlify/core-base","fixed":["11.4.14"],"affected":">= 9.0.0-beta.12, < 11.4.14","ecosystem":"npm"},{"name":"@intlify/core-base","fixed":["12.0.0-alpha.5"],"affected":">= 12.0.0-alpha.1, < 12.0.0-alpha.5","ecosystem":"npm"},{"name":"petite-vue-i18n","fixed":["11.4.14"],"affected":">= 9.2.0-alpha.7, < 11.4.14","ecosystem":"npm"},{"name":"petite-vue-i18n","fixed":["12.0.0-alpha.5"],"affected":">= 12.0.0-alpha.1, < 12.0.0-alpha.5","ecosystem":"npm"},{"name":"@intlify/vue-i18n-core","fixed":["11.4.14"],"affected":">= 9.2.0-alpha.7, < 11.4.14","ecosystem":"npm"},{"name":"@intlify/vue-i18n-core","fixed":["12.0.0-alpha.5"],"affected":">= 12.0.0-alpha.1, < 12.0.0-alpha.5","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-116","cwe-79","frontend","javascript","package","vue","vue-i18n"],"not_affected_if":["escapeparameter-disabled","no-user-input-in-translations","plain-text-output"],"how_to_check":"- Check the installed version of `vue-i18n` in the lockfile or with `npm ls vue-i18n`; affected range is 9.0.0-beta.5 up to 11.4.14 and 12.0.0-alpha.5 (not including).\n- Search the codebase for `escapeParameter` or `escapeParameterHtml` together with `v-html` or `$t` output rendered as HTML.\n- Look for translation calls that pass both a list array and a named object of user-supplied values.","fix":"- Upgrade `vue-i18n` to `11.4.14` or later (or `12.0.0-alpha.5` for the 12 line).\n- Until upgraded, stop passing untrusted named values into HTML-rendered translations or escape them before the call.","status":"open","published_at":"2026-10-28T19:17:30+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","triaged_at":"2026-10-28T19:36:17+00:00","updated_at":"2026-10-28T21:07:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T19:36:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `vue-i18n` to `11.4.14` or later (or `12.0.0-alpha.5` for the 12 line).\n- Until upgraded, stop passing untrusted named values into HTML-rendered translations or escape them before the call.","reach":"internet","title":"Vue I18n: named interpolation values skip HTML escaping when list values are also passed","impact":"medium","summary":"When escapeParameter is enabled and a translation call passes both list and named values, named values are not HTML-escaped, so untrusted named values can inject markup into translations rendered as HTML. The sources say this can enable phishing links, forms and script execution when combined with a sanitizer bypass or on releases without the sanitizer.","category":"package","nicknames":[],"who_cares":["vue","vue-i18n","javascript","frontend"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker injects markup and phishing forms; script may run in some cases","analyst_note":"","how_to_check":"- Check the installed version of `vue-i18n` in the lockfile or with `npm ls vue-i18n`; affected range is 9.0.0-beta.5 up to 11.4.14 and 12.0.0-alpha.5 (not including).\n- Search the codebase for `escapeParameter` or `escapeParameterHtml` together with `v-html` or `$t` output rendered as HTML.\n- Look for translation calls that pass both a list array and a named object of user-supplied values.","needs_analyst":false,"not_affected_if":["plain-text-output","no-user-input-in-translations","escapeParameter-disabled"],"who_is_affected":"Applications using Vue I18n with escapeParameter enabled that render translation output as HTML and pass untrusted named values alongside list values. Apps that only use plain text output or do not feed user input into translation parameters are much less exposed; the sources do not say whether the default configuration enables escapeParameter.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000694,"input_tokens":3443,"output_tokens":700,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-116':49B '-118256':19A,27A '-2025':253C '-2026':18A,26A '-53892':254C '-79':51B '/intlify/vue-i18n/blob/v11.4.13/packages/core-base/src/translate.ts):':183C '0':363C '10.0.8':305C '11.1.10':307C '11.4.14':458C '12.0.0':309C,460C '428q':23A '6c8r':285C,438C '7ww3':24A '83rm':284C,437C '8rc2':22A '9.14.5':304C 'add':250C 'affect':325C,393C 'alpha.1':310C 'alpha.3':312C 'alpha.5':461C 'also':13A,292C,474C 'api':125C 'applic':391C 'attribut':259C 'b':375C,377C 'base':453C 'branch':151C 'bypass':109B 'call':12A,66B,159C,224C,416C,499C,534C 'caller':482C 'carri':226C 'chang':432C 'check':231C,322C 'combin':105B 'compon':553C 'const':351C,367C 'contain':545C 'createi18n':346C,353C 'cve':17A,25A,252C 'cwe':48B,50B 'detail':176C 'dom':452C 'dom-bas':451C 'either':138C,328C 'els':155C,200C 'en':357C,361C 'enabl':62B,97B,120C,396C,538C 'escap':6A,79B,128C,137C,175C,204C,378C,388C,464C,494C,504C 'escapehtml':197C 'escapeparam':136C,177C,186C,462C 'escapeparamet':3A,60B,118C,358C,397C,536C 'escapeparameterhtml':121C 'event':257C 'exampl':163C,403C 'execut':103B,450C 'fals':355C 'field':221C 'first':232C 'fix':280C,456C,473C,518C 'form':100B,273C,429C,495C 'format':133C 'frontend':52B 'function':185C 'g728':286C,439C 'ghsa':21A,283C,436C 'ghsa-83rm-6c8r-g728':282C,435C 'ghsa-8rc2-428q-7ww3':20A 'github.com':182C 'github.com/intlify/vue-i18n/blob/v11.4.13/packages/core-base/src/translate.ts):':181C 'goe':247C 'handler':258C 'html':78B,91B,318C,342C,401C,407C,551C 'html-escap':77B 'i18n':2A,30A,33A,41A,45A,58B,127C,350C,352C 'i18n.global':369C 'impact':390C 'import':345C 'inject':85B 'insert':275C,313C,424C 'instead':555C 'interpol':130C,554C 'intlify/core':34A,35A 'intlify/core-base':36A,37A 'intlify/vue-i18n-core':46A,47A 'isarray':190C 'isobject':202C 'isstr':195C 'item':194C,196C,198C,199C 'javascript':53B,261C 'join':153C 'js':344C 'key':165C,209C 'layout':431C 'lead':447C 'left':239C 'legaci':124C,354C 'link':99B,271C,428C 'list':16A,69B,140C,210C,229C,329C,419C,467C,527C 'local':356C 'longer':512C 'markup':86B,264C,426C 'messag':135C,172C,360C 'migrat':520C 'name':7A,71B,73B,82B,144C,166C,168C,206C,220C,235C,267C,290C,315C,331C,364C,366C,373C,382C,383C,411C,421C,470C,478C,529C 'neutral':256C 'never':333C 'object':479C,489C,503C 'option':187C,211C 'options.list':191C,192C 'options.list.map':193C 'options.named':203C 'overload':215C 'packag':54B 'packages/core-base/src/translate.ts':179C 'paramet':131C 'pass':14A,67B,160C,293C,327C,409C,483C,526C 'patch':455C 'petite':39A,43A 'petite-vue-i18n':38A,42A 'phish':98B,427C 'pleas':519C 'poc':343C 'public':214C 'reach':170C 'releas':112B 'render':89B,339C,398C,541C 'replac':491C 'rewrit':476C 'run':298C 'sanit':108B,115B,295C,302C,445C 'sanitizetranslatedhtml':249C 'say':94B 'script':102B,297C,449C 'second':498C 'singl':158C 'sourc':93B 'still':246C 'stop':475C 'string':245C 'summari':116C 'support':513C 'togeth':433C 'translat':65B,88B,244C,340C,399C,542C 'translateopt':188C,217C 'true':359C 'ts':184C 'twice':506C 'two':150C 'untrust':81B,410C,546C 'url':262C 'use':552C 'v':406C,550C 'v-html':405C,549C 'v10':509C 'v11':522C 'v11.4.13':180C,389C 'v9':507C 'valu':8A,72B,74B,83B,141C,145C,169C,207C,236C,268C,291C,316C,332C,412C,422C,471C,486C,530C,547C 'version':299C,442C 'vue':1A,29A,32A,40A,44A,55B,57B,126C,349C 'vue-i18n':28A,31A,56B,348C 'withlist':362C,380C 'without':113B,173C,300C,319C,443C 'withoutlist':365C,372C 'workaround':523C 'x':374C,376C,384C,386C 'xss':454C","nicknames":[],"mitigations":[],"who_affected":"Applications using Vue I18n with escapeParameter enabled that render translation output as HTML and pass untrusted named values alongside list values. Apps that only use plain text output or do not feed user input into translation parameters are much less exposed; the sources do not say whether the default configuration enables escapeParameter.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T19:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118256","severity":null,"published_at":"2026-10-28T19:17:30+00:00","modified_at":"2026-10-28T19:17:30+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","fetched_at":"2026-10-28T19:34:55+00:00","note":null},{"source":"ghsa","external_id":"GHSA-8rc2-428q-7ww3","url":"https://github.com/advisories/GHSA-8rc2-428q-7ww3","severity":"low","published_at":"2026-10-28T21:06:34+00:00","modified_at":"2026-10-28T21:06:35+00:00","first_seen_at":"2026-10-28T21:07:44+00:00","fetched_at":"2026-10-28T21:07:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}