Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Description

When escapeParameter is enabled (escapeParameterHtml in the Legacy API), Vue I18n passes the translated string through sanitizeTranslatedHtml(). The sanitizer escapes < and > in attribute values and neutralizes event handler attributes such as onerror, but it does not handle the srcdoc attribute of <iframe>.

Recommendation

Update the petite-vue-i18n package to the latest compatible version. Followings are version details:

• Affected version(s): **= 12.0.0-alpha.4

  >= 11.1.10, < 11.4.14

  = 10.0.8

  = 9.14.5**

• Patched version(s): **12.0.0-alpha.5

  11.4.14**

References

• GHSA-83rm-6c8r-g728
• CVE-2026-118257
• CWE-116
• CWE-79
• CAPEC-310