CVE-2026-118257

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118257", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-27T20:13:55.314Z", "datePublished": "2026-10-28T18:23:49.400Z", "dateUpdated": "2026-10-29T20:55:05.780Z"}, "containers": {"cna": {"title": "Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-83rm-6c8r-g728", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-83rm-6c8r-g728"}, {"name": "https://github.com/intlify/vue-i18n/pull/2679", "tags": ["x_refsource_MISC"], "url": "https://github.com/intlify/vue-i18n/pull/2679"}, {"name": "https://github.com/intlify/vue-i18n/commit/43391d20e7c85403cb59bdb21b5d542819f54042", "tags": ["x_refsource_MISC"], "url": "https://github.com/intlify/vue-i18n/commit/43391d20e7c85403cb59bdb21b5d542819f54042"}, {"name": "https://github.com/intlify/vue-i18n/releases/tag/v11.4.14", "tags": ["x_refsource_MISC"], "url": "https://github.com/intlify/vue-i18n/releases/tag/v11.4.14"}, {"name": "https://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5"}], "affected": [{"vendor": "intlify", "product": "vue-i18n", "versions": [{"version": "= 9.14.5", "status": "affected"}, {"version": "= 10.0.8", "status": "affected"}, {"version": ">= 11.1.10, < 11.4.14", "status": "affected"}, {"version": ">= 12.0.0-alpha.4, < 12.0.0-alpha.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T18:23:49.400Z"}, "descriptions": [{"lang": "en", "value": "Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5."}], "source": {"advisory": "GHSA-83rm-6c8r-g728", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T15:43:29.896851Z", "id": "CVE-2026-118257", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T20:55:05.780Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118257", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T15:43:29.896851Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T15:43:30.933Z"}}], "cna": {"title": "Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages", "source": {"advisory": "GHSA-83rm-6c8r-g728", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "intlify", "product": "vue-i18n", "versions": [{"status": "affected", "version": "= 9.14.5"}, {"status": "affected", "version": "= 10.0.8"}, {"status": "affected", "version": ">= 11.1.10, < 11.4.14"}, {"status": "affected", "version": ">= 12.0.0-alpha.4, < 12.0.0-alpha.5"}]}], "references": [{"url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-83rm-6c8r-g728", "name": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-83rm-6c8r-g728", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/intlify/vue-i18n/pull/2679", "name": "https://github.com/intlify/vue-i18n/pull/2679", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/intlify/vue-i18n/commit/43391d20e7c85403cb59bdb21b5d542819f54042", "name": "https://github.com/intlify/vue-i18n/commit/43391d20e7c85403cb59bdb21b5d542819f54042", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/intlify/vue-i18n/releases/tag/v11.4.14", "name": "https://github.com/intlify/vue-i18n/releases/tag/v11.4.14", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5", "name": "https://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116: Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T18:23:49.400Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118257", "state": "PUBLISHED", "dateUpdated": "2026-10-29T20:55:05.780Z", "dateReserved": "2026-10-27T20:13:55.314Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-28T18:23:49.400Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "vue-i18n", "vendor": "intlify", "versions": [{"status": "affected", "version": "= 9.14.5"}, {"status": "affected", "version": "= 10.0.8"}, {"status": "affected", "version": ">= 11.1.10, < 11.4.14"}, {"status": "affected", "version": ">= 12.0.0-alpha.4, < 12.0.0-alpha.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5."}], "id": "CVE-2026-118257", "lastModified": "2026-10-29T21:17:15.557", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118257", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T15:43:29.896851Z", "version": "2.0.3"}}]}, "published": "2026-10-28T19:17:30.207", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/intlify/vue-i18n/commit/43391d20e7c85403cb59bdb21b5d542819f54042"}, {"source": "security-advisories@github.com", "url": "https://github.com/intlify/vue-i18n/pull/2679"}, {"source": "security-advisories@github.com", "url": "https://github.com/intlify/vue-i18n/releases/tag/v11.4.14"}, {"source": "security-advisories@github.com", "url": "https://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-83rm-6c8r-g728"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-116"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "vue-i18n: core-base: vue-i18n: Cross-Site Scripting via improper iframe srcdoc sanitization", "id": "2563089", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563089"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character references and parse the value as a same-origin nested HTML document, allowing attacker-controlled parameters or translation content placed in srcdoc to execute script when applications enable escapeParameter and render translations as HTML through v-html. Versions 9.14.5 and 10.0.8 are also affected and are no longer supported, while i18n-t rendering is not affected. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.", "A flaw was found in vue-i18n. The HTML sanitization mechanism fails to properly neutralize inline frame (iframe) srcdoc attributes when processing translated content. A remote attacker could exploit this vulnerability by injecting malicious parameters or translation data into applications configured to render translations as HTML. Successful exploitation allows the execution of arbitrary script within the user's browser session, leading to Cross-Site Scripting (XSS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-118257", "package_state": [{"cpe": "cpe:/a:redhat:openshift_api_data_protection:1", "fix_state": "Not affected", "package_name": "oadp/oadp-vmfr-access-filebrowser-rhel9", "product_name": "OpenShift API for Data Protection"}], "public_date": "2026-10-28T18:23:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118257\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118257\nhttps://github.com/intlify/vue-i18n/commit/43391d20e7c85403cb59bdb21b5d542819f54042\nhttps://github.com/intlify/vue-i18n/pull/2679\nhttps://github.com/intlify/vue-i18n/releases/tag/v11.4.14\nhttps://github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5\nhttps://github.com/intlify/vue-i18n/security/advisories/GHSA-83rm-6c8r-g728"], "statement": "This vulnerability is evaluated as Moderate severity because successful cross-site scripting requires user interaction alongside specific non-standard application configurations to be exposed. Red Hat products shipping bundled web interfaces using this internationalization library are only susceptible if an application explicitly enables parameter escaping, injects untrusted input into inline frame document attributes, and renders the result as unescaped markup. Standard deployments that avoid dynamic document embedding within localization templates or rely on component-based message interpolation are not exposed to this flaw.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "9.14.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "10.0.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.1.10,11.4.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0-alpha.4,12.0.0-alpha.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "vue-i18n", "source": "cna", "vendor": "intlify"}, "product": "vue-i18n", "vendor": "intlify"}], "created": "2026-10-28T19:45:06.775125+00:00", "updated": "2026-10-28T19:45:07.049251+00:00", "vendors": ["intlify", "intlify$PRODUCT$vue-i18n"]}