Improper Encoding or Escaping of Output Affecting vue-i18n package, versions >=12.0.0-alpha.1 <12.0.0-alpha.5>=9.0.0-beta.5 <11.4.14

vue-i18n is an Internationalization plugin for Vue.js

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the escapeParams function in packages/core-base/src/translate.ts, when a translation call passes both list and named interpolation values simultaneously. The original logic used else if to escape named values, meaning that when a list argument is also present, named values are never passed through escapeHtml. An attacker who controls a named interpolation value can inject unescaped HTML into the rendered output, enabling a cross-site scripting attack.

Note: This is only exploitable when the escapeParameter option is explicitly set to true.

import { createI18n } from 'vue-i18n'

const i18n = createI18n({
  legacy: false,
  locale: 'en',
  escapeParameter: true,
  messages: {
    en: { withList: '{0} {name}', withoutList: '{name}' }
  }
})
const t = i18n.global.t

t('withoutList', { name: '<b>x</b>' })
// &lt;b&gt;x&lt;&#x2F;b&gt;      escaped

t('withList', ['a'], { named: { name: '<b>x</b>' } })
// a <b>x</b>                   not escaped (v11.4.13)

Note: The PoC uses vue-i18n with escapeParameter: true and demonstrates that named values are not escaped when a list argument is also passed.

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release
• GitHub Release