vue-i18n vulnerabilities

2 known vulnerabilities in vue-i18n from Intlify. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  vue-i18n: Improper Neutralization of Input During Web Page Generation

  CVE-2026-118257Oct 28, 2026Intlify

  Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active

• 8.9 High severity

  vue-i18n: Improperly Controlled Modification of Object Prototype Attributes

  CVE-2025-27597Mar 7, 2025Intlify

  Vue I18n is the internationalization plugin for Vue.js. @intlify/message-resolver and @intlify/vue-i18n-core are vulnerable to Prototype Pollution through the entry function: handleFlatJson. An attacker can supply a payload with Object.prototype setter to intr