CVE-2026-118256

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118256", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-27T20:13:55.314Z", "datePublished": "2026-10-28T18:20:14.644Z", "dateUpdated": "2026-10-30T14:19:32.716Z"}, "containers": {"cna": {"title": "Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 2.1, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3"}, {"name": "https://github.com/intlify/vue-i18n/pull/2680", "tags": ["x_refsource_MISC"], "url": "https://github.com/intlify/vue-i18n/pull/2680"}, {"name": "https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8", "tags": ["x_refsource_MISC"], "url": "https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8"}], "affected": [{"vendor": "intlify", "product": "vue-i18n", "versions": [{"version": ">= 9.0.0-beta.5, < 11.4.14", "status": "affected"}, {"version": ">= 12.0.0-alpha.1, < 12.0.0-alpha.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T18:20:14.644Z"}, "descriptions": [{"lang": "en", "value": "Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5."}], "source": {"advisory": "GHSA-8rc2-428q-7ww3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T14:19:23.592827Z", "id": "CVE-2026-118256", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T14:19:32.716Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118256", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T14:19:23.592827Z"}}}], "references": [{"url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T14:19:05.458Z"}}], "cna": {"title": "Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list", "source": {"advisory": "GHSA-8rc2-428q-7ww3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "intlify", "product": "vue-i18n", "versions": [{"status": "affected", "version": ">= 9.0.0-beta.5, < 11.4.14"}, {"status": "affected", "version": ">= 12.0.0-alpha.1, < 12.0.0-alpha.5"}]}], "references": [{"url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3", "name": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/intlify/vue-i18n/pull/2680", "name": "https://github.com/intlify/vue-i18n/pull/2680", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8", "name": "https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116: Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T18:20:14.644Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118256", "state": "PUBLISHED", "dateUpdated": "2026-10-30T14:19:32.716Z", "dateReserved": "2026-10-27T20:13:55.314Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-28T18:20:14.644Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "vue-i18n", "vendor": "intlify", "versions": [{"status": "affected", "version": ">= 9.0.0-beta.5, < 11.4.14"}, {"status": "affected", "version": ">= 12.0.0-alpha.1, < 12.0.0-alpha.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5."}], "id": "CVE-2026-118256", "lastModified": "2026-10-30T15:16:47.017", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118256", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T14:19:23.592827Z", "version": "2.0.3"}}]}, "published": "2026-10-28T19:17:30.060", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8"}, {"source": "security-advisories@github.com", "url": "https://github.com/intlify/vue-i18n/pull/2680"}, {"source": "security-advisories@github.com", "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-116"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "vue-i18n: vue-i18n: HTML injection via unescaped named interpolation parameters", "id": "2563092", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563092"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.", "A flaw was found in vue-i18n. When parameter escaping is enabled, the library fails to properly sanitize named interpolation values if a translation call contains both list and named parameters. A remote attacker could exploit this vulnerability by supplying untrusted input to an application that renders translations as HTML. Successful exploitation can allow an attacker to inject arbitrary HTML markup or execute malicious scripts in a user's browser."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-118256", "package_state": [{"cpe": "cpe:/a:redhat:openshift_api_data_protection:1", "fix_state": "Not affected", "package_name": "oadp/oadp-vmfr-access-filebrowser-rhel9", "product_name": "OpenShift API for Data Protection"}], "public_date": "2026-10-28T18:20:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118256\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118256\nhttps://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8\nhttps://github.com/intlify/vue-i18n/pull/2680\nhttps://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3"], "statement": "This vulnerability is rated as having a Moderate impact because successful exploitation demands an uncommon set of prerequisites: applications must enable parameter escaping, render translation results directly as raw HTML, and simultaneously pass untrusted user input across both positional and named arguments. In typical Red Hat environments, web interfaces either do not expose the affected execution path or do not combine positional and named interpolation parameters in this manner. Additionally, any resulting impact is restricted to client-side markup injection rather than host or server compromise.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0-beta.5,11.4.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0-alpha.1,12.0.0-alpha.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "vue-i18n", "source": "cna", "vendor": "intlify"}, "product": "vue-i18n", "vendor": "intlify"}], "created": "2026-10-28T19:45:06.775331+00:00", "updated": "2026-10-28T20:00:18.302217+00:00", "vendors": ["intlify", "intlify$PRODUCT$vue-i18n"]}