CVE-2026-12295-UXXS-in-my-wasm

CVE-2026-12295 — srcdoc data on a non-about:srcdoc URI Firefox UXSS Proof of concept: a compromised content process forges a PDocumentChannel load whose nsDocShellLoadState carries SrcdocData together with an arbitrary URI. Vulnerable builds serve the attacker HTML as the document at the victim...

CVE-2026-124422 SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder

SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute...

CVE-2026-124422 SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder

SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute...

CVE-2026-124422 SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder

SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean that rebuilds iframes from data-se-iframe-holder-attrs JSON without filtering srcdoc or uppercase SRC keys. Attackers can inject crafted HTML through paste, html.set, or html.insert to execute...

CVE-2026-124422

SunEditor versions 3.0.0 before 3.4.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the html.clean() function. The root cause is the failure to filter srcdoc or uppercase SRC keys when rebuilding iframes from the data-se-iframe-holder-attrs JSON. Attackers can inject ...

PT-2026-139898

Name of the Vulnerable Software and Affected Versions SunEditor versions 3.0.0 through 3.3.x Description A stored cross-site scripting issue exists in the html.clean function. The problem occurs when iframes are rebuilt from data-se-iframe-holder-attrs JSON without properly filtering the srcdoc o...

CVE-2026-118257

A flaw was found in vue-i18n. The HTML sanitization mechanism fails to properly neutralize inline frame iframe srcdoc attributes when processing translated content. A remote attacker could exploit this vulnerability by injecting malicious parameters or translation data into applications configure...

npm: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

npm: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages vulnerability discovered by ? in WordPress npm petite-vue-i18n versions 9.14.5...

GHSA-83RM-6C8R-G728 Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Summary When escapeParameter is enabled escapeParameterHtml in the Legacy API, Vue I18n passes the translated string through sanitizeTranslatedHtml. The sanitizer escapes in attribute values and neutralizes event handler attributes such as onerror, but it does not handle the srcdoc attribute of...

npm: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

npm: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages vulnerability discovered by ? in WordPress npm vue-i18n versions 9.14.5...

Improper Encoding or Escaping of Output

Overview petite-vue-i18n is a Vue I18n lite version Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the sanitizeTranslatedHtml function in packages/shared/src/sanitize.ts, which fails to neutralize srcdoc attributes in translation messages. An...

Improper Encoding or Escaping of Output

Overview @intlify/core-base is a @intlify/core-base Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the sanitizeTranslatedHtml function in packages/shared/src/sanitize.ts, which fails to neutralize srcdoc attributes in translation messages. An...

Improper Encoding or Escaping of Output

Overview vue-i18n is an Internationalization plugin for Vue.js Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the sanitizeTranslatedHtml function in packages/shared/src/sanitize.ts, which fails to neutralize srcdoc attributes in translation message...

Improper Encoding or Escaping of Output

Overview @intlify/vue-i18n-core is a @intlify/vue-i18n-core Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the sanitizeTranslatedHtml function in packages/shared/src/sanitize.ts, which fails to neutralize srcdoc attributes in translation messages. ...

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Summary When escapeParameter is enabled escapeParameterHtml in the Legacy API, Vue I18n passes the translated string through sanitizeTranslatedHtml. The sanitizer escapes in attribute values and neutralizes event handler attributes such as onerror, but it does not handle the srcdoc attribute of...

Improper Encoding or Escaping of Output

Overview @intlify/shared is a @intlify/shared Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the sanitizeTranslatedHtml function in packages/shared/src/sanitize.ts, which fails to neutralize srcdoc attributes in translation messages. An attacker wh...

Improper Encoding or Escaping of Output

Overview @intlify/core is a @intlify/core Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the sanitizeTranslatedHtml function in packages/shared/src/sanitize.ts, which fails to neutralize srcdoc attributes in translation messages. An attacker who...

CVE-2026-118257

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...

CVE-2026-118257

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...

EUVD-2026-112359

Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml escapes markup and event-handler text inside an iframe srcdoc value but leaves the srcdoc attribute active. Browsers decode the character...