Login Request a demo
VU
Product
vue-i18n
by intlify · last CVE Oct 28, 2026
6
CVEs
0
On KEV
8.9
Max CVSS
2
New 30D
Vulnerabilities6In the news0Timeline
Severity mix
Critical 0High 2Medium 3Low 1
Severity
All severities6Critical0High2Medium3Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add vue-i18n to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-27597
8.9
1%
Mar 7
Vue I18n Prototype Pollution in `handleFlatJson`
Affected: >= 9.1.0, < 9.14.3; >= 10.0.0-alpha.1, < 10.0.6; >= 11.0.0-beta.0, < 11.1.2
CVE-2026-118257
New
7.2–Oct 28
Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
Affected: = 9.14.5; = 10.0.8; >= 11.1.10, < 11.4.14; >= 12.0.0-alpha.4, < 12.0.0-alpha.5
CVE-2024-52810
6.9
1%
Nov 29
Prototype Pollution in @intlify/shared >=9.7.0 <= 10.0.4
Affected: >= 9.7.0, < 9.14.2; >= 10.0.0, < 10.0.5
CVE-2025-53892
5.3
1%
Jul 16
Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror
Affected: >= 9.0.0, < 9.14.5; >= 10.0.0, < 10.0.8; >= 11.0.0, < 11.1.0
CVE-2024-52809
5.3
1%
Nov 29
Cross-site Scripting vulnerability with prototype pollution in vue-i18n
Affected: < 9.14.2; >= 10.0.0, < 10.0.5
CVE-2026-118256
New
2.1–Oct 28
Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list
Affected: >= 9.0.0-beta.5, < 11.4.14; >= 12.0.0-alpha.1, < 12.0.0-alpha.5
Showing 6