Improper Encoding or Escaping of Output Affecting vue-i18n package, versions >=12.0.0-alpha.4 <12.0.0-alpha.5>=11.1.10 <11.4.14

vue-i18n is an Internationalization plugin for Vue.js

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the sanitizeTranslatedHtml function in packages/shared/src/sanitize.ts, which fails to neutralize srcdoc attributes in translation messages. An attacker who controls translation message content can inject a srcdoc attribute on an <iframe> element; the browser entity-decodes the attribute value and parses it as a full HTML document in the same origin as the page, allowing arbitrary script execution. The existing sanitizer neutralized on* event handlers but did not account for the secondary HTML parsing context that srcdoc introduces, leaving that vector unblocked.

import { createI18n } from 'vue-i18n'

const i18n = createI18n({
  legacy: false,
  locale: 'en',
  escapeParameter: true,
  messages: {
    en: { message: '<iframe srcdoc="<b>x</b>"></iframe>' }
  }
})

console.log(i18n.global.t('message'))
// v11.4.13: <iframe srcdoc="&lt;b&gt;x&lt;/b&gt;"></iframe>

The browser decodes the value and renders <b>x</b> as a separate document inside the <iframe>, in the same origin as the page. Any markup in that position is parsed the same way.

Note: The PoC uses vue-i18n with legacy: false and escapeParameter: true, demonstrating that the srcdoc attribute value survives sanitization and is decoded by the browser.

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release
• GitHub Release