Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@intlify/core-base

5 known vulnerabilities (2 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
11.4.18 (Nov 3, 2026): no advisory affects it
Newest unaffected release
11.4.18 (Nov 3, 2026), the latest release
Advisories
5 · 2 high, 2 medium, 1 low
Weekly downloads
4.9M
Releases
227 since 9.0.0 (Feb 27, 2021)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-118257
    Affects 9.14.5 (10.0.0-alpha.1 is outside it); 10.0.8 (11.0.0-beta.0 is outside it); 11.1.10 to 11.4.13 (11.4.14 is outside it); 12.0.0-alpha.4 (12.0.0-alpha.5 is outside it)
  • CVE-2026-118256
    Affects 9.0.0-beta.12 to 11.4.13 (11.4.14 is outside it); 12.0.0-alpha.1 to 12.0.0-alpha.4 (12.0.0-alpha.5 is outside it)
  • CVE-2025-53892
    Affects 9.0.0 to 9.14.4 (9.14.5 is outside it); 10.0.0 to 10.0.7 (10.0.8 is outside it); 11.0.0 to 11.1.9 (11.1.10 is outside it)
  • CVE-2025-27597
    Affects 9.1.0 to 9.1.10 (9.1.11 is outside it)
  • CVE-2024-52809
    Affects 9.3.0 to 9.14.1 (9.14.2 is outside it); 10.0.0 to 10.0.4 (10.0.5 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

    Affected: versions 9.14.5; versions 10.0.8; from 11.1.10, fixed in 11.4.14; from 12.0.0-alpha.4, fixed in 12.0.0-alpha.5.

    Fixed in 11.4.14 (released Oct 10, 2026, 18 days before disclosure) and 12.0.0-alpha.5 (released Oct 10, 2026, 18 days before disclosure).

    The latest release, 11.4.18, is not affected.

    57% of @intlify/core-base downloads last week were affected versions (3M).

  • Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

    Affected: from 9.0.0-beta.12, fixed in 11.4.14; from 12.0.0-alpha.1, fixed in 12.0.0-alpha.5.

    Fixed in 11.4.14 (released Oct 10, 2026, 18 days before disclosure) and 12.0.0-alpha.5 (released Oct 10, 2026, 18 days before disclosure).

    The latest release, 11.4.18, is not affected.

    71% of @intlify/core-base downloads last week were affected versions (3.8M).

  • CVE-2025-53892Medium 5.3

    Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror

    Affected: from 9.0.0, fixed in 9.14.5; from 10.0.0, fixed in 10.0.8; from 11.0.0, fixed in 11.1.10.

    Fixed in 9.14.5 (released Jul 16, 2025, the day of disclosure), 10.0.8 (released Jul 16, 2025, the day of disclosure) and 11.1.10 (released Jul 16, 2025, the day of disclosure).

    The latest release, 11.4.18, is not affected.

    14% of @intlify/core-base downloads last week were affected versions (733.1K).

  • Vue I18n Prototype Pollution in `handleFlatJson`

    Affected: from 9.1.0, fixed in 9.1.11.

    Fixed in 9.1.11 (released Mar 7, 2025, the day of disclosure).

    The latest release, 11.4.18, is not affected.

    1.2% of @intlify/core-base downloads last week were affected versions (66K).

  • CVE-2024-52809Medium 5.3

    Cross-site Scripting vulnerability with prototype pollution in vue-i18n

    Affected: from 9.3.0, fixed in 9.14.2; from 10.0.0, fixed in 10.0.5.

    Fixed in 9.14.2 (released Nov 28, 2024, 1 day before disclosure) and 10.0.5 (released Nov 28, 2024, 1 day before disclosure).

    The latest release, 11.4.18, is not affected.

    4.4% of @intlify/core-base downloads last week were affected versions (236.2K).