Zero Radar
← feed
LowVulnerabilityCVE-2026-118256updated 29 Oct 2026, 15:54 UTC

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

Fix availableOfficial, 2 sources
SeverityLowCVSS 2.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesvue-i18n 11.4.14, vue-i18n 12.0.0-alpha.5, @intlify/core 11.4.14, @intlify/core 12.0.0-alpha.5, @intlify/core-base 11.4.14, @intlify/core-base 12.0.0-alpha.5 · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

Are you affected?

Package / productAffected versionsFixed in
vue-i18n · npm>= 9.0.0-beta.5, < 11.4.1411.4.14
vue-i18n · npm>= 12.0.0-alpha.1, < 12.0.0-alpha.512.0.0-alpha.5
@intlify/core · npm>= 9.0.0-beta.10, < 11.4.1411.4.14
@intlify/core · npm>= 12.0.0-alpha.1, < 12.0.0-alpha.512.0.0-alpha.5
@intlify/core-base · npm>= 9.0.0-beta.12, < 11.4.1411.4.14
@intlify/core-base · npm>= 12.0.0-alpha.1, < 12.0.0-alpha.512.0.0-alpha.5
petite-vue-i18n · npm>= 9.2.0-alpha.7, < 11.4.1411.4.14
petite-vue-i18n · npm>= 12.0.0-alpha.1, < 12.0.0-alpha.512.0.0-alpha.5
@intlify/vue-i18n-core · npm>= 9.2.0-alpha.7, < 11.4.1411.4.14
@intlify/vue-i18n-core · npm>= 12.0.0-alpha.1, < 12.0.0-alpha.512.0.0-alpha.5

Timeline

  1. 28 Oct 2026, 19:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 21:06 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 28 Oct 2026, 21:06 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 15:54 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118256 · GHSA-8rc2-428q-7ww3
CVSS
2.1 / 10
Disclosed
28 Oct 2026, 19:17 UTC
On Zero Radar
28 Oct 2026, 21:06 UTC (2 h after disclosure)
Last change
29 Oct 2026, 15:54 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list · Zero Radar