# petite-vue-i18n (npm) vulnerabilities 6 known vulnerabilities (2 high, 3 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 11.4.18 (Nov 3, 2026): no advisory affects it - Newest unaffected release: 11.4.18 (Nov 3, 2026), the latest release - Weekly downloads: 8,758 - Releases: 190 since 9.2.0 (Aug 1, 2022) - Registry: https://www.npmjs.com/package/petite-vue-i18n - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-118257: 9.14.5 (10.0.0-alpha.1 is outside it); 10.0.8 (11.0.0-beta.0 is outside it); 11.1.10 to 11.4.13 (11.4.14 is outside it); 12.0.0-alpha.4 (12.0.0-alpha.5 is outside it) - CVE-2026-118256: 9.2.0-alpha.7 to 11.4.13 (11.4.14 is outside it); 12.0.0-alpha.1 to 12.0.0-alpha.4 (12.0.0-alpha.5 is outside it) - CVE-2025-53892: 10.0.0 to 10.0.7 (10.0.8 is outside it); 11.0.0 to 11.1.9 (11.1.10 is outside it) - CVE-2025-27597: 10.0.0 to 10.0.5 (10.0.6 is outside it); 11.0.0-beta.0 to 11.1.1 (11.1.2 is outside it) - CVE-2024-52810: 10.0.0 to 10.0.4 (10.0.5 is outside it) - CVE-2024-52809: 10.0.0 to 10.0.4 (10.0.5 is outside it) ## Advisories (6) ### [CVE-2026-118257](https://cve.now/CVE-2026-118257): Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages - Severity: High 7.2 - Published: Oct 28, 2026 - Affected: versions 9.14.5; versions 10.0.8; from 11.1.10, fixed in 11.4.14; from 12.0.0-alpha.4, fixed in 12.0.0-alpha.5. - Fixed in 11.4.14 (released Oct 10, 2026, 18 days before disclosure) and 12.0.0-alpha.5 (released Oct 10, 2026, 18 days before disclosure). - The latest release, 11.4.18, is not affected. - 54% of petite-vue-i18n downloads last week were affected versions (4.4K). ### [CVE-2026-118256](https://cve.now/CVE-2026-118256): Vue I18n: \`escapeParameter\` does not escape named values when the same call also passes a list - Severity: Low 2.1 - Published: Oct 28, 2026 - Affected: from 9.2.0-alpha.7, fixed in 11.4.14; from 12.0.0-alpha.1, fixed in 12.0.0-alpha.5. - Fixed in 11.4.14 (released Oct 10, 2026, 18 days before disclosure) and 12.0.0-alpha.5 (released Oct 10, 2026, 18 days before disclosure). - The latest release, 11.4.18, is not affected. - 68% of petite-vue-i18n downloads last week were affected versions (5.5K). ### [CVE-2025-53892](https://cve.now/CVE-2025-53892): Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerror - Severity: Medium 5.3 - Published: Jul 16, 2025 - Affected: from 10.0.0, fixed in 10.0.8; from 11.0.0, fixed in 11.1.10. - Fixed in 10.0.8 (released Jul 16, 2025, the day of disclosure) and 11.1.10 (released Jul 16, 2025, the day of disclosure). - The latest release, 11.4.18, is not affected. - 4% of petite-vue-i18n downloads last week were affected versions (330). ### [CVE-2025-27597](https://cve.now/CVE-2025-27597): Vue I18n Prototype Pollution in \`handleFlatJson\` - Severity: High 8.9 - Published: Mar 7, 2025 - Affected: from 10.0.0, fixed in 10.0.6; from 11.0.0-beta.0, fixed in 11.1.2. - Fixed in 10.0.6 (released Mar 7, 2025, the day of disclosure) and 11.1.2 (released Mar 7, 2025, the day of disclosure). - The latest release, 11.4.18, is not affected. - 2.7% of petite-vue-i18n downloads last week were affected versions (225). ### [CVE-2024-52810](https://cve.now/CVE-2024-52810): Prototype Pollution in @intlify/shared \>=9.7.0 \<= 10.0.4 - Severity: Medium 6.9 - Published: Nov 29, 2024 - Affected: from 10.0.0, fixed in 10.0.5. - Fixed in 10.0.5 (released Nov 28, 2024, 1 day before disclosure). - The latest release, 11.4.18, is not affected. - 0.5% of petite-vue-i18n downloads last week were affected versions (38). ### [CVE-2024-52809](https://cve.now/CVE-2024-52809): Cross-site Scripting vulnerability with prototype pollution in vue-i18n - Severity: Medium 5.3 - Published: Nov 29, 2024 - Affected: from 10.0.0, fixed in 10.0.5. - Fixed in 10.0.5 (released Nov 28, 2024, 1 day before disclosure). - The latest release, 11.4.18, is not affected. - 0.5% of petite-vue-i18n downloads last week were affected versions (38). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/petite-vue-i18n Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.