Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list - @intlify/core

Description

When escapeParameter is enabled (escapeParameterHtml in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. escapeParams() escapes either the list values or the named values, but not both: the two branches are joined by else. When a single call passes both, for example t(key, ['...'], { named: { ... } }), the named values reach the message without being escaped.

Recommendation

Update the @intlify/core package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 12.0.0-alpha.1, < 12.0.0-alpha.5

  >= 9.0.0-beta.10, < 11.4.14**

• Patched version(s): **12.0.0-alpha.5

  11.4.14**

References

• GHSA-8rc2-428q-7ww3
• CVE-2026-118256
• CWE-116
• CWE-79
• CAPEC-310