Executive brief
vue-i18n is a popular internationalization library for Vue.js applications that manages translations and locale messages. An attacker can inject malicious code through prototype pollution to achieve cross-site scripting (XSS) when locale message ASTs are used directly, particularly in development environments or custom configurations. This allows attackers to execute arbitrary JavaScript in users' browsers and steal sensitive data or compromise application functionality.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw combined with prototype pollution that affects vue-i18n's message compilation and rendering pipeline. When the library processes Abstract Syntax Tree (AST) objects generated by the message compiler, it does not properly validate prototype properties. An attacker can pollute Object.prototype with malicious properties that are then accessed during AST traversal and translation rendering, leading to arbitrary code execution. The attack requires either development mode usage or direct AST injection from an untrusted source; production builds using @intlify/unplugin-vue-i18n are typically protected by the build-time compilation process. User interaction is required (visiting a compromised page). Patches are available in versions 9.14.2, 10.0.5, and later for all affected packages.
Affected products
- Intlify vue-i18n 9.3.0 to 10.0.4
- Intlify @intlify/core 9.3.0 to 10.0.4
- Intlify @intlify/core-base 9.3.0 to 10.0.4
- Intlify @intlify/vue-i18n-core 9.3.0 to 10.0.4
- Intlify petite-vue-i18n 10.0.0 to 10.0.4
Timeline
- 2024-11-28: disclosed
- 2024-12-02: patched: Patches released: vue-i18n 9.14.2 and 10.0.5; @intlify/core 9.14.2 and 10.0.5; @intlify/core-base 9.14.2 and 10.0.5; @intlify/vue-i18n-core 9.14.2 and 10.0.5; petite-vue-i18n 10.0.5