CVE-2025-54075 mdc vulnerable to XSS in markdown rendering bypassing HTML filter. (N°4)

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored cross-site scripting vulnerability in @nuxtjs/mdc lets a Markdown author inject a element. The tag rewrites how all subsequent relative...

CVE-2025-54075

Summary: CVE-2025-54075 affects @nuxtjs/mdc (Nuxt MDC) before version 0.17.2, where Markdown rendering allows a remote script-inclusion / stored XSS via injecting a tag. The vulnerability rewrites how subsequent relative URLs are resolved, enabling loading of scripts, styles, or images from atta...

CVE-2025-53892

Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fail...

Cross-site Scripting (XSS)

Vue I18n is vulnerable to Cross-site Scripting XSS. The vulnerability is due to incomplete escaping of interpolated parameters caused by the failure of the escapeParameterHtml: true option to prevent tag-based payload execution when rendered using v-html, even with minor HTML in translation strin...

@acronis-platform/ui-component-library (1.33.0), @aesoper/i18n (>=1.0.56, <=1.0.57) +31 more potentially affected by CVE-2025-53892 via vue-i18n (>=10.0.0, <=10.0.7)

vue-i18n NPM version =10.0.0, =1.0.56, =1.0.0, =0.0.16, =2.4.8, =3.0.0, =4.0.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.13.0 and more Source cves: CVE-2025-53892 Source advisory: OSV:GHSA-X8QP-WQQM-57PH...

vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes

Summary The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution of certain tag-based payloads, such as , if the interpolated value is inserted inside an HTML context...

@actindo/core-ui (>=1.0.1, <=1.0.20), @dv.net/docs-vitepress-openapi (>=1.0.7, <=1.0.8) +47 more potentially affected by CVE-2025-53892 via vue-i18n (>=11.0.0, <=11.1.7)

vue-i18n NPM version =11.0.0, =1.0.1, =1.0.7, =1.1.2-app-13.7.1, =1.0.95, =0.0.1, =0.0.1, =0.0.1, =3.1.55, =0.0.15, =0.2.550, =0.2.0, =0.2.2 and more Source cves: CVE-2025-53892 Source advisory: OSV:GHSA-X8QP-WQQM-57PH...

@acegroup/cli-templates-vue3-element-admin (1.0.0), @actindo/core-ui (>=0.0.12, <=0.0.75) +416 more potentially affected by CVE-2025-53892 via vue-i18n (>=9.0.0, <=9.14.4)

vue-i18n NPM version =9.0.0, =0.0.12, =0.0.1, =0.0.1, =0.0.1, =0.0.0-next.5436b378dff7e64898bb7046afa2d5d574255b54, =0.0.0-next.0d1cf82f9dfbe1d3e7ec5644f85f97a43c8c2334, =0.7.0-beta.15, =0.7.0-beta.15, =0.0.23, =0.0.6-alpha-2.5, =0.1.87, =3.0.3, =4.0.3, =4.0.25 and more Source cves: CVE-2025-5389...

petite-vue-i18n (9.2.0-alpha.7), vue-i18n (9.2.0-alpha.7) potentially affected by CVE-2025-53892 via @intlify/vue-i18n-core (9.2.0-alpha.7)

@intlify/vue-i18n-core NPM version 9.2.0-alpha.7 is affected by a known vulnerability. The following packages have a transitive dependency on @intlify/vue-i18n-core and may be impacted: - petite-vue-i18n 9.2.0-alpha.7 - vue-i18n 9.2.0-alpha.7 Source cves: CVE-2025-53892 Source advisory:...

GHSA-X8QP-WQQM-57PH vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes

Summary The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution of certain tag-based payloads, such as , if the interpolated value is inserted inside an HTML context...

CVE-2025-53892

Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fail...

CVE-2025-53892 Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror

Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fail...

CVE-2025-53892 Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror

Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fail...

CVE-2025-53892

CVE-2025-53892 (Vue I18n) describes a DOM-based XSS in the Vue I18n escapeParameterHtml: true option. Vulnerability occurs when interpolated parameters are rendered inside HTML via v-html, allowing tag-based payloads (e.g., ) to execute in versions before fixes. The advisory notes affected ranges...

CVE-2025-53892 Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror

Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fail...

Cross-site Scripting (XSS)

Overview org.webjars.npm:vue-i18n is an Internationalization plugin for Vue.js Affected versions of this package are vulnerable to Cross-site Scripting XSS when performing translations with escapeParameterHtml set to true. An attacker can execute arbitrary JavaScript code in the context of the...

Cross-site Scripting (XSS)

Overview org.webjars.bowergithub.kazupon:vue-i18n is an Internationalization plugin for Vue.js Affected versions of this package are vulnerable to Cross-site Scripting XSS when performing translations with escapeParameterHtml set to true. An attacker can execute arbitrary JavaScript code in the...

PT-2025-29827

Name of the Vulnerable Software and Affected Versions Vue I18n versions 9.0.0 through 9.14.4 Vue I18n versions 10.0.0 through 10.0.7 Vue I18n versions 11.0.0 through 11.0.9 Description Vue I18n, an internationalization plugin for Vue.js, contains a flaw in the escapeParameterHtml: true option. Th...

vue-i18n 跨站脚本漏洞

vue-i18n is an application from intlify open source. A cross-site scripting vulnerability exists in vue-i18n versions prior to 9.0.0 through 9.14.5, prior to 10.0.8, and prior to 11.1.0, which stems from insufficient HTML context parameter escaping and could lead to a DOM-type cross-site scriptin...

CVE-2025-6925

A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath...