Vue I18n Allows Prototype Pollution in `handleFlatJson` (GHSA-p2ph-7g93-hw3m)

Description

Vulnerability type: Prototype Pollution

Vulnerability Location(s):

Description:

The latest version of @intlify/message-resolver (9.1) and @intlify/vue-i18n-core (9.2 or later), (previous versions might also affected), is vulnerable to Prototype Pollution through the entry function(s) handleFlatJson.

Recommendation

Update the @intlify/vue-i18n-core package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 11.0.0-beta.0, < 11.1.2

  >= 10.0.0-alpha.1, < 10.0.6

  >= 9.2.0, < 9.14.3**

• Patched version(s): **11.1.2

  9.14.3**

References

• GHSA-p2ph-7g93-hw3m
• CVE-2025-27597
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes (GHSA-x8qp-wqqm-57ph) - CVE-2025-53892
• Astro's server source code is exposed to the public if sourcemaps are enabled - CVE-2024-56159
• @intlify/shared Prototype Pollution vulnerability (GHSA-hjwq-mjwj-4x6c) - CVE-2024-52810
• vue-i18n has cross-site scripting vulnerability with prototype pollution (GHSA-9r9m-ffp6-9x4v) - CVE-2024-52809

Tags:

npm

@intlify/vue-i18n-core