Skip to main content
cve.nowby Sazabi
← npm
npmPackage

petite-vue-i18n

6 known vulnerabilities (2 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
11.4.18 (Nov 3, 2026): no advisory affects it
Newest unaffected release
11.4.18 (Nov 3, 2026), the latest release
Advisories
6 · 2 high, 3 medium, 1 low
Weekly downloads
8,758
Releases
190 since 9.2.0 (Aug 1, 2022)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-118257
    Affects 9.14.5 (10.0.0-alpha.1 is outside it); 10.0.8 (11.0.0-beta.0 is outside it); 11.1.10 to 11.4.13 (11.4.14 is outside it); 12.0.0-alpha.4 (12.0.0-alpha.5 is outside it)
  • CVE-2026-118256
    Affects 9.2.0-alpha.7 to 11.4.13 (11.4.14 is outside it); 12.0.0-alpha.1 to 12.0.0-alpha.4 (12.0.0-alpha.5 is outside it)
  • CVE-2025-53892
    Affects 10.0.0 to 10.0.7 (10.0.8 is outside it); 11.0.0 to 11.1.9 (11.1.10 is outside it)
  • CVE-2025-27597
    Affects 10.0.0 to 10.0.5 (10.0.6 is outside it); 11.0.0-beta.0 to 11.1.1 (11.1.2 is outside it)
  • CVE-2024-52810
    Affects 10.0.0 to 10.0.4 (10.0.5 is outside it)
  • CVE-2024-52809
    Affects 10.0.0 to 10.0.4 (10.0.5 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

    Affected: versions 9.14.5; versions 10.0.8; from 11.1.10, fixed in 11.4.14; from 12.0.0-alpha.4, fixed in 12.0.0-alpha.5.

    Fixed in 11.4.14 (released Oct 10, 2026, 18 days before disclosure) and 12.0.0-alpha.5 (released Oct 10, 2026, 18 days before disclosure).

    The latest release, 11.4.18, is not affected.

    54% of petite-vue-i18n downloads last week were affected versions (4.4K).

  • Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

    Affected: from 9.2.0-alpha.7, fixed in 11.4.14; from 12.0.0-alpha.1, fixed in 12.0.0-alpha.5.

    Fixed in 11.4.14 (released Oct 10, 2026, 18 days before disclosure) and 12.0.0-alpha.5 (released Oct 10, 2026, 18 days before disclosure).

    The latest release, 11.4.18, is not affected.

    68% of petite-vue-i18n downloads last week were affected versions (5.5K).

  • CVE-2025-53892Medium 5.3

    Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror

    Affected: from 10.0.0, fixed in 10.0.8; from 11.0.0, fixed in 11.1.10.

    Fixed in 10.0.8 (released Jul 16, 2025, the day of disclosure) and 11.1.10 (released Jul 16, 2025, the day of disclosure).

    The latest release, 11.4.18, is not affected.

    4% of petite-vue-i18n downloads last week were affected versions (330).

  • Vue I18n Prototype Pollution in `handleFlatJson`

    Affected: from 10.0.0, fixed in 10.0.6; from 11.0.0-beta.0, fixed in 11.1.2.

    Fixed in 10.0.6 (released Mar 7, 2025, the day of disclosure) and 11.1.2 (released Mar 7, 2025, the day of disclosure).

    The latest release, 11.4.18, is not affected.

    2.7% of petite-vue-i18n downloads last week were affected versions (225).

  • CVE-2024-52810Medium 6.9

    Prototype Pollution in @intlify/shared >=9.7.0 <= 10.0.4

    Affected: from 10.0.0, fixed in 10.0.5.

    Fixed in 10.0.5 (released Nov 28, 2024, 1 day before disclosure).

    The latest release, 11.4.18, is not affected.

    0.5% of petite-vue-i18n downloads last week were affected versions (38).

  • CVE-2024-52809Medium 5.3

    Cross-site Scripting vulnerability with prototype pollution in vue-i18n

    Affected: from 10.0.0, fixed in 10.0.5.

    Fixed in 10.0.5 (released Nov 28, 2024, 1 day before disclosure).

    The latest release, 11.4.18, is not affected.

    0.5% of petite-vue-i18n downloads last week were affected versions (38).