Advisories for Npm/@Intlify/Core package

When escapeParameter is enabled (escapeParameterHtml in the Legacy API), Vue I18n passes the translated string through sanitizeTranslatedHtml(). The sanitizer escapes < and > in attribute values and neutralizes event handler attributes such as onerror, but it does not handle the srcdoc attribute of <iframe>. The value of srcdoc is an HTML document: the browser decodes the character references in it and parses the result as a nested document in the …

When escapeParameter is enabled (escapeParameterHtml in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. escapeParams() escapes either the list values or the named values, but not both: the two branches are joined by else. When a single call passes both, for example t(key, ['…'], { named: { … } }), the named values reach the message without being escaped.

The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution of certain tag-based payloads, such as <img src=x onerror=…>, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via …

Vulnerability type: Prototype Pollution Vulnerability Location(s):

vue-i18n can be passed locale messages to createI18n or useI18n. we can then translate them using t and $t. vue-i18n has its own syntax for local messages, and uses a message compiler to generate AST. In order to maximize the performance of the translation function, vue-i18n uses bundler plugins such as @intlify/unplugin-vue-i18n and bulder to convert the AST in advance when building the application. By using that AST as the …