Medium severity · published Nov 29, 2024
CVE-2024-52809
Cross-site Scripting vulnerability with prototype pollution in vue-i18n
5.3
CVSS
0.7%
EPSS
No
On KEV
Description
vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibility of Cross-site Scripting attack. This issue has been addressed in versions 9.14.2, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VU
vue-i18n · intlify
< 9.14.2; >= 10.0.0, < 10.0.5 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52809
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52809
github.com
https://github.com/intlify/vue-i18n/commit/72f0d323006fc7363b18cab62d4522dadd874411
github.com
https://github.com/intlify/vue-i18n/commit/9f20909ef8c9232a1072d7818e12ed6d6451024d
github.com
https://github.com/intlify/vue-i18n/security/advisories/GHSA-9r9m-ffp6-9x4v
More from vue-i18n
8.9
CVE-2025-27597
Vue I18n Prototype Pollution in `handleFlatJson`
7.2
CVE-2026-118257
Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
6.9
CVE-2024-52810
Prototype Pollution in @intlify/shared >=9.7.0 <= 10.0.4
5.3
CVE-2025-53892
Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror
2.1
CVE-2026-118256
Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list