vue-i18n has cross-site scripting vulnerability with prototype pollution

🗓️ 02 Dec 2024 17:26:20Reported by GitHub Advisory DatabaseType

vue-i18n XSS vulnerability with prototype pollution. vue-i18n can be passed locale messages to `createI18n` or `useI18n`, then translate them using `t` and `$t`

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-52809	29 Nov 202418:41	–	circl
CNNVD	vue-i18n 跨站脚本漏洞	29 Nov 202400:00	–	cnnvd
CVE	CVE-2024-52809	29 Nov 202418:32	–	cve
Cvelist	CVE-2024-52809 Cross-site Scripting vulnerability with prototype pollution in vue-i18n	29 Nov 202418:32	–	cvelist
EUVD	EUVD-2024-3455	3 Oct 202520:07	–	euvd
NVD	CVE-2024-52809	29 Nov 202419:15	–	nvd
OSV	CVE-2024-52809 Cross-site Scripting vulnerability with prototype pollution in vue-i18n	29 Nov 202418:32	–	osv
OSV	GHSA-9R9M-FFP6-9X4V vue-i18n has cross-site scripting vulnerability with prototype pollution	2 Dec 202417:26	–	osv
Positive Technologies	PT-2024-35457 · Vue-I18N · Vue-I18N	29 Nov 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-52809	23 May 202510:32	–	redhatcve

Vulners

Node

intlify vue-i18n-coreRange10.0.0–10.0.5npm

intlify vue_i18n_coreRange10.0.0–10.0.5npm

intlify vue-i18nRange10.0.0–10.0.5npm

intlify core-baseRange10.0.0–10.0.5npm

petite-vue-i18nRange10.0.0–10.0.5npm

intlify vue-i18n-coreRange9.3.0–9.14.2npm

intlify vue_i18n_coreRange9.3.0–9.14.2npm

intlify vue-i18nRange9.3.0–9.14.2npm

intlify core-baseRange9.3.0–9.14.2npm

Source	Link
github	www.github.com/intlify/vue-i18n/security/advisories/GHSA-9r9m-ffp6-9x4v
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-52809
github	www.github.com/intlify/vue-i18n/commit/72f0d323006fc7363b18cab62d4522dadd874411
github	www.github.com/intlify/vue-i18n/commit/9f20909ef8c9232a1072d7818e12ed6d6451024d
github	www.github.com/advisories/GHSA-9r9m-ffp6-9x4v

02 Dec 2024 17:26Current

6.1Medium risk

Vulners AI Score6.1

CVSS 45.3

EPSS0.00647

SSVC

CWE-79