GHSA-83rm-6c8r-g728 Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

• npm vue-i18n: 9.14.5 (no fix yet) • npm vue-i18n: 10.0.8 (no fix yet) • npm vue-i18n: >= 11.1.10, < 11.4.14 → fixed in 11.4.14 • npm vue-i18n: >= 12.0.0-alpha.4, < 12.0.0-alpha.5 → fixed in 12.0.0-alpha.5 • npm petite-vue-i18n: 9.14.5 (no fix yet) • npm petite-vue-i18n: 10.0.8 (no fix yet) • npm petite-vue-i18n: >= 11.1.10, < 11.4.14 → fixed in 11.4.14 • npm petite-vue-i18n: >= 12.0.0-alpha.4, < 12.0.0-alpha.5 → fixed in 12.0.0-alpha.5 • npm @intlify/core-base: 9.14.5 (no fix yet) • npm @intlify/core-base: 10.0.8 (no fix yet) • npm @intlify/core-base: >= 11.1.10, < 11.4.14 → fixed in 11.4.14 • npm @intlify/core-base: >= 12.0.0-alpha.4, < 12.0.0-alpha.5 → fixed in 12.0.0-alpha.5 • npm @intlify/core: 9.14.5 (no fix yet) • npm @intlify/core: 10.0.8 (no fix yet) • npm @intlify/core: >= 11.1.10, < 11.4.14 → fixed in 11.4.14 • npm @intlify/core: >= 12.0.0-alpha.4, < 12.0.0-alpha.5 → fixed in 12.0.0-alpha.5 • npm @intlify/vue-i18n-core: 9.14.5 (no fix yet) • npm @intlify/vue-i18n-core: 10.0.8 (no fix yet) • npm @intlify/vue-i18n-core: >= 11.1.10, < 11.4.14 → fixed in 11.4.14 • npm @intlify/vue-i18n-core: >= 12.0.0-alpha.4, < 12.0.0-alpha.5 → fixed in 12.0.0-alpha.5 • npm @intlify/shared: 9.14.5 (no fix yet) • npm @intlify/shared: 10.0.8 (no fix yet) • npm @intlify/shared: >= 11.1.10, < 11.4.14 → fixed in 11.4.14 • npm @intlify/shared: >= 12.0.0-alpha.4, < 12.0.0-alpha.5 → fixed in 12.0.0-alpha.5

Summary When `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n passes the translated string through `sanitizeTranslatedHtml()`. The sanitizer escapes `` in attribute values and neutralizes event handler attributes such as `onerror`, but it does not handle the `srcdoc` attribute of ``. The value of `srcdoc` is an HTML document: the browser decodes the character references in it and parses the result as a nested document in the same origin. The escaping and the neutralization done by the sanitizer are both character references, so they are undone inside `srcdoc`. This bypasses the fix for CVE-2025-53892 (GHSA-x8qp-wqqm-57ph). Details `sanitizeTranslatedHtml()` (`packages/shared/src/sanitize.ts` in v11.4.13) works on the final translated string: 1. It escapes ``, `"` and `'` inside quoted attribute values. 2. It rewrites the `on` of event handler attributes to `&#111;n`. 3. It replaces `javascript:` URLs in `href`, `src`, `action` and `formaction` with `about:blank`. Inside `srcdoc`, steps 1 and 2 only produce character references, which the browser decodes before parsing the value as a document. Markup inside `srcdoc` therefore survives the sanitizer, with escaping or without it. This can be reached in three ways: • A parameter inside `srcdoc`. With a message such as ``, `escapeParameter` escapes `content` into character references, and the browser decodes them again. • Markup in a message. A message that contains an `` keeps it after sanitizing. The documentation asks not to use HTML messages with content from users, but it also says that the sanitizer neutralizes event handlers in the final HTML. • Together with GHSA-8rc2-428q-7ww3. When a call passes a list and named values, the named values are not escaped. An `` in a named value then reaches the sanitizer as markup, even with an ordinary message such as `{0} {name}`. PoC ```js import { createI18n } from 'vue-i18n' const i18n = createI18n({ legacy: false, locale: 'en', escapeParameter: true, messages: { en: { message: 'x">' } } }) console.log(i18n.global.t('message')) // v11.4.13: ``` The browser decodes the value and renders `x` as a separate document inside the ``, in the same origin as the page. Any markup in that position is parsed the same way. Impact Applications are affected when they enable `escapeParameter`, render translations as HTML (for example with `v-html`), and one of the following applies: • an untrusted value is passed as a parameter that the message places inside `srcdoc`, • message content is not fully trusted (for example crowdsourced or stored translations), or • untrusted named values are passed in the same call as a list (GHSA-8rc2-428q-7ww3). An attacker can then run script in the origin of the application (DOM-based XSS), despite the sanitizer. Rendering through `` is not affected, since it does not render translations as HTML. Patches Fixed in 11.4.14 and 12.0.0-alpha.5. The sanitizer now neutralizes the `srcdoc` attribute itself, in the same way as event handler attributes. v9 and v10 are no longer supported and will not be fixed. Please migrate to v11. Workarounds • Do not render translations that can contain untrusted content with `v-html`. Use component interpolation (``) instead. • Do not put `srcdoc` in translation messages, and do not pass values into it. References • CWE-79, CWE-116 • GHSA-x8qp-wqqm-57ph (CVE-2025-53892): the fix that added `sanitizeTranslatedHtml()` • GHSA-8rc2-428q-7ww3: named values are not escaped when a list is also passed • HTML Standard: the `srcdoc` attribute