Zero Radar
← feed
HighVulnerabilityCVE-2026-118257updated 28 Oct 2026, 21:06 UTC

Vue I18n can run attacker scripts through iframe content in translations

Vue I18n is a tool that shows text in different languages on websites. A flaw lets specially crafted text hidden inside an iframe run its own code on the page, which can expose user data or actions.

Partial fixOfficial, 2 sources
SeverityHighCVSS 7.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Partly11.4.14 (for 11.x), 12.0.0-alpha.5 (for 12 alpha); 9.x and 10.x have no listed fixed version · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker supplies contentMalicious value sent as a parameter or translation
  2. 2Translation renderedescapeParameter on, shown via v-html
  3. 3Browser decodes srcdocEscaped markup becomes live HTML again
  4. 4Script runs in iframeRuns as same-origin nested document
  5. ResultAttacker script runs on the site

What happened

sanitizeTranslatedHtml() escapes markup inside iframe srcdoc attribute values, but browsers decode the character references and parse the value as a same-origin nested HTML document, so script can execute. This bypasses the earlier fix for CVE-2025-53892.

Why it is dangerous: An attacker who can supply a parameter or translation content used in an iframe srcdoc can run script in the same origin as the site, potentially stealing session data or acting as the user.

Are you affected?

You are affected if you use vue-i18n or petite-vue-i18n or @intlify/core-base with escapeParameter enabled, render translations as HTML via v-html, and untrusted values or untrusted translation content reach an iframe srcdoc.

Package / productAffected versionsFixed in
vue-i18n · npm= 9.14.5no fix yet
vue-i18n · npm= 10.0.8no fix yet
vue-i18n · npm>= 11.1.10, < 11.4.1411.4.14
vue-i18n · npm= 12.0.0-alpha.412.0.0-alpha.5
petite-vue-i18n · npm= 9.14.5no fix yet
petite-vue-i18n · npm= 10.0.8no fix yet
petite-vue-i18n · npm>= 11.1.10, < 11.4.1411.4.14
petite-vue-i18n · npm= 12.0.0-alpha.412.0.0-alpha.5
@intlify/core-base · npm= 9.14.5no fix yet
@intlify/core-base · npm= 10.0.8no fix yet
@intlify/core-base · npm>= 11.1.10, < 11.4.1411.4.14
@intlify/core-base · npm= 12.0.0-alpha.412.0.0-alpha.5
@intlify/core · npm= 9.14.5no fix yet
@intlify/core · npm= 10.0.8no fix yet
@intlify/core · npm>= 11.1.10, < 11.4.1411.4.14
@intlify/core · npm= 12.0.0-alpha.412.0.0-alpha.5
@intlify/vue-i18n-core · npm= 9.14.5no fix yet
@intlify/vue-i18n-core · npm= 10.0.8no fix yet
@intlify/vue-i18n-core · npm>= 11.1.10, < 11.4.1411.4.14
@intlify/vue-i18n-core · npm= 12.0.0-alpha.412.0.0-alpha.5
@intlify/shared · npm= 9.14.5no fix yet
@intlify/shared · npm= 10.0.8no fix yet
@intlify/shared · npm>= 11.1.10, < 11.4.1411.4.14
@intlify/shared · npm= 12.0.0-alpha.412.0.0-alpha.5

What to do

  1. Update vue-i18n, petite-vue-i18n and @intlify/core-base to 11.4.14 or later (or 12.0.0-alpha.5 or later)
  2. Move 9.x and 10.x users to a supported version, since those lines are no longer supported
  3. Until patched, avoid rendering translations with v-html or do not place untrusted values in iframe srcdoc

Timeline

  1. 28 Oct 2026, 19:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 19:17 UTC
    Reported by NVD · NVD
  3. 28 Oct 2026, 19:17 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 21:06 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 28 Oct 2026, 21:06 UTC
    Fixed version published: vue-i18n 11.4.14, vue-i18n 12.0.0-alpha.5, petite-vue-i18n 11.4.14 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118257 · GHSA-83rm-6c8r-g728
CVSS
7.2 / 10
Disclosed
28 Oct 2026, 19:17 UTC
On Zero Radar
28 Oct 2026, 19:17 UTC (0 min after disclosure)
Last change
28 Oct 2026, 21:06 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Vue I18n can run attacker scripts through iframe content in translations · Zero Radar