Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Summary When escapeParameter is enabled escapeParameterHtml in the Legacy API, Vue I18n passes the translated string through sanitizeTranslatedHtml. The sanitizer escapes in attribute values and neutralizes event handler attributes such as onerror, but it does not handle the srcdoc attribute of...

GHSA-83RM-6C8R-G728 Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Summary When escapeParameter is enabled escapeParameterHtml in the Legacy API, Vue I18n passes the translated string through sanitizeTranslatedHtml. The sanitizer escapes in attribute values and neutralizes event handler attributes such as onerror, but it does not handle the srcdoc attribute of...

CVE-2026-118257

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...

EUVD-2026-112359

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...

PT-2026-129124

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...