Skip to content

Commit eaf88f6

Browse files
advisory-database[bot]advisory-database[bot]
committed
1 parent c3ef0a2 commit eaf88f6

File tree

1 file changed

+336
-0
lines changed

1 file changed

+336
-0
lines changed

‎advisories/github-reviewed/2025/07/GHSA-x8qp-wqqm-57ph/GHSA-x8qp-wqqm-57ph.json

Lines changed: 336 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,336 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-x8qp-wqqm-57ph",
4+
"modified": "2025-07-16T19:32:49Z",
5+
"published": "2025-07-16T19:32:48Z",
6+
"aliases": [
7+
"CVE-2025-53892"
8+
],
9+
"summary": "vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes",
10+
"details": "### Summary\nThe escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution of certain tag-based payloads, such as <img src=x onerror=...>, if the interpolated value is inserted inside an HTML context using v-html.\n\nThis may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html.\n\n### Details\n\nWhen escapeParameterHtml: true is enabled, it correctly escapes common injection points.\n\nHowever, it does not sanitize entire attribute contexts, which can be used as XSS vectors via:\n\n`<img src=x onerror=alert(1)>\n`\n### PoC\nIn your Vue I18n configuration:\n\n```\nconst i18n = createI18n({\n escapeParameterHtml: true,\n messages: {\n en: {\n vulnerable: 'Caution: <img src=x onerror=\"{payload}\">'\n }\n }\n});\n```\nUse this interpolated payload:\n\n`const payload = '<script>alert(\"xss\")</script>';`\nRender the translation using v-html (even not using v-html):\n\n`<p v-html=\"$t('vulnerable', { payload })\"></p>\n`\nExpected: escaped content should render as text, not execute.\n\nActual: script executes in some environments (or the payload is partially parsed as HTML).\n\n### Impact\n\nThis creates a DOM-based Cross-Site Scripting (XSS) vulnerability despite enabling a security option (escapeParameterHtml) .",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "vue-i18n"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "9.0.0"
29+
},
30+
{
31+
"fixed": "9.14.5"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "vue-i18n"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "10.0.0"
48+
},
49+
{
50+
"fixed": "10.0.8"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "npm",
59+
"name": "vue-i18n"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "11.0.0"
67+
},
68+
{
69+
"fixed": "11.1.10"
70+
}
71+
]
72+
}
73+
]
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "npm",
78+
"name": "@intlify/core"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "9.0.0"
86+
},
87+
{
88+
"fixed": "9.14.5"
89+
}
90+
]
91+
}
92+
]
93+
},
94+
{
95+
"package": {
96+
"ecosystem": "npm",
97+
"name": "@intlify/core"
98+
},
99+
"ranges": [
100+
{
101+
"type": "ECOSYSTEM",
102+
"events": [
103+
{
104+
"introduced": "10.0.0"
105+
},
106+
{
107+
"fixed": "10.0.8"
108+
}
109+
]
110+
}
111+
]
112+
},
113+
{
114+
"package": {
115+
"ecosystem": "npm",
116+
"name": "@intlify/core"
117+
},
118+
"ranges": [
119+
{
120+
"type": "ECOSYSTEM",
121+
"events": [
122+
{
123+
"introduced": "11.0.0"
124+
},
125+
{
126+
"fixed": "11.1.10"
127+
}
128+
]
129+
}
130+
]
131+
},
132+
{
133+
"package": {
134+
"ecosystem": "npm",
135+
"name": "@intlify/core-base"
136+
},
137+
"ranges": [
138+
{
139+
"type": "ECOSYSTEM",
140+
"events": [
141+
{
142+
"introduced": "9.0.0"
143+
},
144+
{
145+
"fixed": "9.14.5"
146+
}
147+
]
148+
}
149+
]
150+
},
151+
{
152+
"package": {
153+
"ecosystem": "npm",
154+
"name": "@intlify/core-base"
155+
},
156+
"ranges": [
157+
{
158+
"type": "ECOSYSTEM",
159+
"events": [
160+
{
161+
"introduced": "10.0.0"
162+
},
163+
{
164+
"fixed": "10.0.8"
165+
}
166+
]
167+
}
168+
]
169+
},
170+
{
171+
"package": {
172+
"ecosystem": "npm",
173+
"name": "@intlify/core-base"
174+
},
175+
"ranges": [
176+
{
177+
"type": "ECOSYSTEM",
178+
"events": [
179+
{
180+
"introduced": "11.0.0"
181+
},
182+
{
183+
"fixed": "11.1.10"
184+
}
185+
]
186+
}
187+
]
188+
},
189+
{
190+
"package": {
191+
"ecosystem": "npm",
192+
"name": "@intlify/vue-i18n-core"
193+
},
194+
"ranges": [
195+
{
196+
"type": "ECOSYSTEM",
197+
"events": [
198+
{
199+
"introduced": "9.2.0"
200+
},
201+
{
202+
"fixed": "9.14.5"
203+
}
204+
]
205+
}
206+
]
207+
},
208+
{
209+
"package": {
210+
"ecosystem": "npm",
211+
"name": "@intlify/vue-i18n-core"
212+
},
213+
"ranges": [
214+
{
215+
"type": "ECOSYSTEM",
216+
"events": [
217+
{
218+
"introduced": "10.0.0"
219+
},
220+
{
221+
"fixed": "10.0.8"
222+
}
223+
]
224+
}
225+
]
226+
},
227+
{
228+
"package": {
229+
"ecosystem": "npm",
230+
"name": "@intlify/vue-i18n-core"
231+
},
232+
"ranges": [
233+
{
234+
"type": "ECOSYSTEM",
235+
"events": [
236+
{
237+
"introduced": "11.0.0"
238+
},
239+
{
240+
"fixed": "11.1.10"
241+
}
242+
]
243+
}
244+
]
245+
},
246+
{
247+
"package": {
248+
"ecosystem": "npm",
249+
"name": "petite-vue-i18n"
250+
},
251+
"ranges": [
252+
{
253+
"type": "ECOSYSTEM",
254+
"events": [
255+
{
256+
"introduced": "10.0.0"
257+
},
258+
{
259+
"fixed": "10.0.8"
260+
}
261+
]
262+
}
263+
]
264+
},
265+
{
266+
"package": {
267+
"ecosystem": "npm",
268+
"name": "petite-vue-i18n"
269+
},
270+
"ranges": [
271+
{
272+
"type": "ECOSYSTEM",
273+
"events": [
274+
{
275+
"introduced": "11.0.0"
276+
},
277+
{
278+
"fixed": "11.1.10"
279+
}
280+
]
281+
}
282+
]
283+
}
284+
],
285+
"references": [
286+
{
287+
"type": "WEB",
288+
"url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph"
289+
},
290+
{
291+
"type": "ADVISORY",
292+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53892"
293+
},
294+
{
295+
"type": "WEB",
296+
"url": "https://github.com/intlify/vue-i18n/pull/2229"
297+
},
298+
{
299+
"type": "WEB",
300+
"url": "https://github.com/intlify/vue-i18n/pull/2230"
301+
},
302+
{
303+
"type": "WEB",
304+
"url": "https://github.com/intlify/vue-i18n/commit/49f982443ab8fd94ecc427b265ce97d57df94d7e"
305+
},
306+
{
307+
"type": "WEB",
308+
"url": "https://github.com/intlify/vue-i18n/commit/a47099619fb9b256e86341a8658ebe72e92ab099"
309+
},
310+
{
311+
"type": "PACKAGE",
312+
"url": "https://github.com/intlify/vue-i18n"
313+
},
314+
{
315+
"type": "WEB",
316+
"url": "https://github.com/intlify/vue-i18n/releases/tag/v10.0.8"
317+
},
318+
{
319+
"type": "WEB",
320+
"url": "https://github.com/intlify/vue-i18n/releases/tag/v11.1.10"
321+
},
322+
{
323+
"type": "WEB",
324+
"url": "https://github.com/intlify/vue-i18n/releases/tag/v9.14.5"
325+
}
326+
],
327+
"database_specific": {
328+
"cwe_ids": [
329+
"CWE-79"
330+
],
331+
"severity": "MODERATE",
332+
"github_reviewed": true,
333+
"github_reviewed_at": "2025-07-16T19:32:48Z",
334+
"nvd_published_at": "2025-07-16T14:15:28Z"
335+
}
336+
}

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy