CVE-2025-53892: vue-i18n DOM-based XSS Vulnerability via escapeParameterHtml
Summary
CVE-2025-53892: vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes. Affects vue-i18n across 3 version ranges.
>= 9.0.0, < 9.14.5
>= 10.0.0, < 10.0.8
>= 11.0.0, < 11.1.10
Fixed in 9.14.5, 10.0.8 or 11.1.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vue I18n is a popular internationalization plugin for Vue.js applications, enabling developers to easily manage translations and localization. It provides features such as message formatting, pluralization, and date/time formatting. However, a security flaw exists in its escapeParameterHtml option, which is intended to prevent HTML/script injection but fails to fully sanitize certain tag attributes, leading to potential DOM-based XSS attacks.
Vulnerability Detail
The vulnerability arises from the escapeParameterHtml: true setting in Vue I18n, which is supposed to escape interpolated parameters to prevent HTML/script injection. However, it does not adequately sanitize entire attribute contexts, allowing attackers to exploit this weakness by injecting malicious payloads into translation strings. For example, using an image tag with an onerror attribute can execute arbitrary JavaScript when rendered with v-html, leading to a DOM-based XSS vulnerability. This can occur even when the escapeParameterHtml option is enabled, posing a significant security risk to applications that rely on this feature.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.0, < 9.14.59.14.5npm install vue-i18n@9.14.5 -
>= 10.0.0, < 10.0.810.0.8npm install vue-i18n@10.0.8 -
>= 11.0.0, < 11.1.1011.1.10npm install vue-i18n@11.1.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using v-html to render translation strings that include dynamic content. Instead, use regular text interpolation to prevent the execution of potentially harmful scripts. For example, instead of:
<p v-html="$t('vulnerable', { payload })"></p>
Use:
<p>{{ $t('vulnerable', { payload }) }}</p>
Conclusion
The CVE-2025-53892 vulnerability in vue-i18n highlights a significant security risk related to DOM-based XSS attacks. By understanding the nature of this vulnerability and following the recommended steps to update the affected packages, developers can protect their applications from potential exploitation. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for open-source vulnerabilities.
See every vulnerability recorded for vue-i18n →
FAQ
The vulnerability can lead to DOM-based XSS attacks, allowing attackers to execute arbitrary JavaScript in the context of the user's browser, potentially compromising user data and application integrity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By analyzing your package-lock.json file, Vulert can help you identify if your application is affected by this vulnerability.
Versions of vue-i18n from 9.0.0 to 9.14.4, 10.0.0 to 10.0.7, and 11.0.0 to 11.1.9 are affected by this vulnerability.
Yes, you can avoid using v-html for rendering translation strings that include dynamic content, opting for text interpolation instead.
If an immediate update is not possible, implement the workaround by avoiding v-html and ensure that your application is monitored for any suspicious activity.
