Listen to this Post
The `escapeParameterHtml` option in Vue-i18n (v9.0.0+) fails to fully sanitize interpolated values when rendered via v-html, allowing DOM-based XSS through malicious HTML attributes. The vulnerability occurs because the function only escapes literal HTML tags but does not neutralize event handlers (e.g., onerror, onload) within attribute contexts. When a translation string containing user-controlled input is processed with v-html, attackers can inject payloads like <img src=x onerror=alert(1)>. The `escapeParameterHtml` setting mistakenly assumes attribute values are safe after basic escaping, but browsers still parse and execute JavaScript in event handlers.
DailyCVE Form
Platform: Vue-i18n
Version: 9.0.0-9.14.4
Vulnerability: DOM-based XSS
Severity: Critical
Date: 2025-07-16
Prediction: Patch by 2025-07-30
What Undercode Say
npm audit vue-i18n --json | grep CVE-2025-12345
// Verify vulnerability
const i18n = createI18n({ escapeParameterHtml: true });
How Exploit
<img src=x onerror="fetch('/steal?cookie='+document.cookie)">
Protection from this CVE
- Upgrade to vue-i18n 9.14.5+
- Avoid `v-html` with translations
- Use CSP directives
Impact
- Session hijacking
- Malware delivery
- UI manipulation
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
