Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…e-i18n/security/advisories/GHSA-8rc2-428q-7ww3 Diğer
• github.com/intlify/vue-i18n/pull/2680 Diğer
• github.com/…ommit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8 Diğer

Kayıt geçmişi

1. 28 Eki 2026 21:20Yayımlandı

İlgili açıklar

• 7,2 CVE-2026-118257Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
• 6,1 CVE-2026-118652Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
• 9,4 CVE-2026-63190FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
• 6,1 CVE-2026-11854Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
• 7,3 CVE-2026-118648n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy
• 8,4 CVE-2026-118255Highcharts Grid: javascript: URL in credits.href runs script on click