CVE-2025-53892mediumCWE-79

CVE-2025-53892: falha de média gravidade em intlify vue-i18n

Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar vue-i18n+ Monitorar @intlify/vue-i18n-core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.8%
Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as <img src=x onerror=...>, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
intlify · vue-i18n
CVEs relacionadas — intlify vue-i18n

No mesmo produto, das mais perigosas para as menos.

CVE-2024-52810MEDIUMPrototype Pollution in @intlify/shared >=9.7.0 <= 10.0.4EPSS 0.8%CVE-2024-52809MEDIUMCross-site Scripting vulnerability with prototype pollution in vue-i18nEPSS 0.7%CVE-2025-27597HIGHVue I18n Prototype Pollution in `handleFlatJson`EPSS 0.6%CVE-2026-118256LOWVue I18n: `escapeParameter` does not escape named values when the same call also passes a listEPSS 0.5%CVE-2026-118257HIGHVue I18n: escapeParameter does not prevent XSS through srcdoc in translation messagesEPSS 0.3%