Skip to content
Fencer Vulns
medium 5.3

CVE-2025-53892 json

Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror

published 2025-07-16 15 mo ago modified 2026-09-10 1 mo ago also GHSA-x8qp-wqqm-57ph , EUVD-2025-21704

cvss
5.3
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits
0
none known

Summary

Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as <img src=x onerror=...>, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue.

Patch / fix

  • npm vue-i18n 9.14.5, 10.0.8, 11.1.10
  • npm @intlify/core 9.14.5, 10.0.8, 11.1.10
  • npm @intlify/core-base 9.14.5, 10.0.8, 11.1.10
  • npm @intlify/vue-i18n-core 9.14.5, 10.0.8, 11.1.10
  • npm petite-vue-i18n 10.0.8, 11.1.10

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
15 mo ago

Exploit prediction

0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CNA 4.0 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
npm vue-i18n
>=9.0.0, <9.14.5
>=10.0.0, <10.0.8
>=11.0.0, <11.1.10
9.14.5
10.0.8
11.1.10
npm @intlify/core
>=9.0.0, <9.14.5
>=10.0.0, <10.0.8
>=11.0.0, <11.1.10
9.14.5
10.0.8
11.1.10
npm @intlify/core-base
>=9.0.0, <9.14.5
>=10.0.0, <10.0.8
>=11.0.0, <11.1.10
9.14.5
10.0.8
11.1.10
npm @intlify/vue-i18n-core
>=9.2.0, <9.14.5
>=10.0.0, <10.0.8
>=11.0.0, <11.1.10
9.14.5
10.0.8
11.1.10
npm petite-vue-i18n
>=10.0.0, <10.0.8
>=11.0.0, <11.1.10
10.0.8
11.1.10

Affected products

  • intlify vue-i18n

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.