# CVE-2024-52809: vue-i18n cross-site scripting with prototype pollution

Source: https://junglewise.ai/threats/cve-2024-52809-vue-i18n-cross-site-scripting-with-prototype-pollution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-12-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-52809 · Severity: medium · CVSS 4 · Published 2024-12-02

vue-i18n is a popular internationalization library for Vue.js applications that manages translations and locale messages. An attacker can inject malicious code through prototype pollution to achieve cross-site scripting (XSS) when locale message ASTs are used directly, particularly in development environments or custom configurations. This allows attackers to execute arbitrary JavaScript in users' browsers and steal sensitive data or compromise application functionality.

Technologies: [@intlify/core (npm)](https://junglewise.ai/threats/technologies/intlify-core), [@intlify/core-base (npm)](https://junglewise.ai/threats/technologies/intlify-core-base), [@intlify/vue-i18n-core (npm)](https://junglewise.ai/threats/technologies/intlify-vue-i18n-core), [petite-vue-i18n (npm)](https://junglewise.ai/threats/technologies/petite-vue-i18n), [vue-i18n (npm)](https://junglewise.ai/threats/technologies/vue-i18n). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-52809 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-52809 being exploited in the wild.

**How severe is CVE-2024-52809?** Medium severity, with a CVSS score of 4, published 2 December 2024.

**Which products and versions are affected?** @intlify/core (npm) SEMVER:introduced=9.3.0,fixed=9.14.2; @intlify/core-base (npm) SEMVER:introduced=9.3.0,fixed=9.14.2; @intlify/vue-i18n-core (npm) SEMVER:introduced=9.3.0,fixed=9.14.2; petite-vue-i18n (npm) SEMVER:introduced=10.0.0,fixed=10.0.5; and 1 more.

**Is there a fix for CVE-2024-52809?** Yes. @intlify/core (npm): upgrade to 9.14.2 or later; @intlify/core-base (npm): upgrade to 9.14.2 or later; @intlify/vue-i18n-core (npm): upgrade to 9.14.2 or later; petite-vue-i18n (npm): upgrade to 10.0.5 or later; vue-i18n (npm): upgrade to 9.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-52809 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-52809?** Check whether you run @intlify/core (npm), @intlify/core-base (npm), @intlify/vue-i18n-core (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @intlify/core (npm): upgrade to 9.14.2 or later

  ```sh
  npm install @intlify/core@9.14.2
  ```

- @intlify/core-base (npm): upgrade to 9.14.2 or later

  ```sh
  npm install @intlify/core-base@9.14.2
  ```

- @intlify/vue-i18n-core (npm): upgrade to 9.14.2 or later

  ```sh
  npm install @intlify/vue-i18n-core@9.14.2
  ```

- petite-vue-i18n (npm): upgrade to 10.0.5 or later

  ```sh
  npm install petite-vue-i18n@10.0.5
  ```

- vue-i18n (npm): upgrade to 9.14.2 or later

  ```sh
  npm install vue-i18n@9.14.2
  ```


## Technical details

The vulnerability is a cross-site scripting (XSS) flaw combined with prototype pollution that affects vue-i18n's message compilation and rendering pipeline. When the library processes Abstract Syntax Tree (AST) objects generated by the message compiler, it does not properly validate prototype properties. An attacker can pollute Object.prototype with malicious properties that are then accessed during AST traversal and translation rendering, leading to arbitrary code execution. The attack requires either development mode usage or direct AST injection from an untrusted source; production builds using @intlify/unplugin-vue-i18n are typically protected by the build-time compilation process. User interaction is required (visiting a compromised page). Patches are available in versions 9.14.2, 10.0.5, and later for all affected packages.

## Affected products

- Intlify vue-i18n 9.3.0 to 10.0.4
- Intlify @intlify/core 9.3.0 to 10.0.4
- Intlify @intlify/core-base 9.3.0 to 10.0.4
- Intlify @intlify/vue-i18n-core 9.3.0 to 10.0.4
- Intlify petite-vue-i18n 10.0.0 to 10.0.4

## Identifiers

- CVE-2024-52809
- GHSA-9r9m-ffp6-9x4v

## Timeline

- 2024-11-28: disclosed
- 2024-12-02: patched: Patches released: vue-i18n 9.14.2 and 10.0.5; @intlify/core 9.14.2 and 10.0.5; @intlify/core-base 9.14.2 and 10.0.5; @intlify/vue-i18n-core 9.14.2 and 10.0.5; petite-vue-i18n 10.0.5

## References

- [https://github.com/intlify/vue-i18n/security/advisories/GHSA-9r9m-ffp6-9x4v](https://github.com/intlify/vue-i18n/security/advisories/GHSA-9r9m-ffp6-9x4v)

## Related threats

- [Vue I18n XSS in sanitizeTranslatedHtml srcdoc escaping](https://junglewise.ai/threats/cve-2026-118257-vue-i18n-is-the-internationalization-plugin-for-vue-js-from-11-1)
- [Vue I18n XSS in escapeParameter with named interpolation](https://junglewise.ai/threats/cve-2026-118256-vue-i18n-is-the-internationalization-plugin-for-vue-js-from-9-0)
- [vue-i18n escapeParameterHtml DOM-based XSS in tag attributes](https://junglewise.ai/threats/cve-2025-53892-vue-i18n-escapeparameterhtml-dom-based-xss-in-tag-attributes)
- [Intlify Vue I18n prototype pollution in handleFlatJson](https://junglewise.ai/threats/cve-2025-27597-intlify-vue-i18n-prototype-pollution-in-handleflatjson)
- [Intlify shared prototype pollution in deepCopy](https://junglewise.ai/threats/cve-2024-52810-intlify-shared-prototype-pollution-in-deepcopy)