@intlify/core-base
npm5 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting @intlify/core-basepage 1 of 1
- CVE-2024-52809MEDIUMCVSS 5.3EG 5.3fixed in 9.14.2 or 10.0.5, by version range2024-11-29
vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibility of Cross-si…
- CVE-2025-27597HIGHCVSS 8.9EG 8.9fixed in 9.1.112025-03-07
Vue I18n is the internationalization plugin for Vue.js. @intlify/message-resolver and @intlify/vue-i18n-core are vulnerable to Prototype Pollution through the entry function: handleFlatJson. An attacker can supply a payload with Object.pro…
- CVE-2025-53892MEDIUMCVSS 5.3EG 5.3fixed in 9.14.5, 10.0.8 or 11.1.10, by version range2025-07-16
Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior…
- CVE-2026-118256LOWCVSS 2.1EG 2.1fixed in 11.4.14 or 12.0.0-alpha.5, by version range2026-10-28
Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same tr…
- CVE-2026-118257HIGHCVSS 7.2EG 7.2fixed in 11.4.14 or 12.0.0-alpha.5, by version range2026-10-28
vulnerable: 9.14.5
Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the sr…
Check whether @intlify/core-base is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for @intlify/core-base CVEs against the assets you own.
Book a Demo →