Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages - @intlify/vue-i18n-core

Description

When escapeParameter is enabled (escapeParameterHtml in the Legacy API), Vue I18n passes the translated string through sanitizeTranslatedHtml(). The sanitizer escapes < and > in attribute values and neutralizes event handler attributes such as onerror, but it does not handle the srcdoc attribute of <iframe>.

Recommendation

Update the @intlify/vue-i18n-core package to the latest compatible version. Followings are version details:

• Affected version(s): **= 12.0.0-alpha.4

  >= 11.1.10, < 11.4.14

  = 10.0.8

  = 9.14.5**

• Patched version(s): **12.0.0-alpha.5

  11.4.14**

References

• GHSA-83rm-6c8r-g728
• CVE-2026-118257
• CWE-116
• CWE-79
• CAPEC-310