CVE-2026-118257

Name of the Vulnerable Software and Affected Versions Vue I18n versions 11.1.10 through 11.4.13 Vue I18n versions 12.0.0-alpha.4 through 12.0.0-alpha.4 Vue I18n version 9.14.5 Vue I18n version 10.0.8

Description When escapeParameter is enabled and translations are rendered as HTML via v-html, the sanitizeTranslatedHtml() function fails to properly handle the srcdoc attribute of <iframe> elements. While the sanitizer escapes markup and neutralizes event handlers, browsers decode these character references when parsing the srcdoc value as a same-origin nested HTML document. This allows attacker-controlled parameters or translation content placed within srcdoc to execute arbitrary scripts in the application's origin, leading to DOM-based Cross-Site Scripting (XSS). This issue can be triggered if untrusted values are passed as parameters into srcdoc, if translation messages contain untrusted HTML, or if untrusted named values are used in conjunction with a list.

Recommendations Update to version 11.4.14 or later. Update to version 12.0.0-alpha.5 or later. Migrate to version 11 for versions 9.14.5 and 10.0.8 as they are no longer supported. Avoid rendering translations that may contain untrusted content using v-html and use component interpolation instead. Do not include the srcdoc attribute in translation messages and avoid passing values into it.