CVE-2026-118257

20th percentile - higher than 20% of all known CVEs

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Script execution in the hosting page context is possible, potentially leading to session or application data theft. The risk affects applications using Vue I18n with escapeParameter and v-html plus untrusted translations or parameters.

Update Vue I18n to version 11.4.14 or 12.0.0-alpha.5 (or later) and migrate off unsupported 9.x and 10.x versions. Avoid rendering translations via v-html with untrusted data.