CVE-2026-118257: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
When escapeParameter is enabled (escapeParameterHtml in the Legacy API), Vue I18n passes the translated string through sanitizeTranslatedHtml(). The sanitizer escapes < and > in attribute values and neutralizes event handler attributes such as onerror, but it does not handle the srcdoc attribute of <iframe>.
The value of srcdoc is an HTML document: the browser decodes the character references in it and parses the result as a nested document in the same origin. The escaping and the neutralization done by the sanitizer are both character references, so they are undone inside srcdoc. This bypasses the fix for CVE-2025-53892 (GHSA-x8qp-wqqm-57ph).
References
- github.com/advisories/GHSA-83rm-6c8r-g728
- github.com/intlify/vue-i18n/commit/43391d20e7c85403cb59bdb21b5d542819f54042
- github.com/intlify/vue-i18n/pull/2679
- github.com/intlify/vue-i18n/releases/tag/v11.4.14
- github.com/intlify/vue-i18n/releases/tag/v12.0.0-alpha.5
- github.com/intlify/vue-i18n/security/advisories/GHSA-83rm-6c8r-g728
- nvd.nist.gov/vuln/detail/CVE-2026-118257
Code Behaviors & Features
Detect and mitigate CVE-2026-118257 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →