Improper output handling vulnerability in intlify vue-i18n

A security vulnerability exists in intlify Vue-i18n versions prior to 9.0.0-beta.5 and 11.4.14, as well as versions prior to 12.0.0-alpha.1 and 12.0.0-alpha.5. This vulnerability arises when escapeParameter in older API versions, escapeParameterHtml is enabled; in such cases, escapeParams only...

PT-2026-129123

Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because...