vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - @intlify/core-base

Description

The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution of certain tag-based payloads, such as <img src=x onerror=...>, if the interpolated value is inserted inside an HTML context using v-html.

Recommendation

Update the @intlify/core-base package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 11.0.0, < 11.1.10

  >= 10.0.0, < 10.0.8

  >= 9.0.0, < 9.14.5**

• Patched version(s): **11.1.10

  10.0.8

  9.14.5**

References

• GHSA-x8qp-wqqm-57ph
• CVE-2025-53892
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6