# CVE-2024-52810: Intlify shared prototype pollution in deepCopy

Source: https://junglewise.ai/threats/cve-2024-52810-intlify-shared-prototype-pollution-in-deepcopy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-12-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-52810 · Severity: medium · CVSS 4 · Published 2024-12-02

@intlify/shared is a utility library used by Vue.js internationalization frameworks to handle language translation and localization features. A prototype pollution vulnerability in the deepCopy function allows attackers to inject malicious properties into JavaScript's global object prototype, potentially causing application crashes or enabling injection attacks that could lead to arbitrary code execution depending on how the application uses the library.

Technologies: [@intlify/vue-i18n-core (npm)](https://junglewise.ai/threats/technologies/intlify-vue-i18n-core), [petite-vue-i18n (npm)](https://junglewise.ai/threats/technologies/petite-vue-i18n), [vue-i18n (npm)](https://junglewise.ai/threats/technologies/vue-i18n). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-52810 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-52810 being exploited in the wild.

**How severe is CVE-2024-52810?** Medium severity, with a CVSS score of 4, published 2 December 2024.

**Which products and versions are affected?** @intlify/shared (npm) SEMVER:introduced=9.7.0,fixed=9.14.2; @intlify/vue-i18n-core (npm) SEMVER:introduced=9.7.0,fixed=9.14.2; petite-vue-i18n (npm) SEMVER:introduced=10.0.0,fixed=10.0.5; vue-i18n (npm) SEMVER:introduced=9.7.0,fixed=9.14.2.

**Is there a fix for CVE-2024-52810?** Yes. @intlify/shared (npm): upgrade to 9.14.2 or later; @intlify/vue-i18n-core (npm): upgrade to 9.14.2 or later; petite-vue-i18n (npm): upgrade to 10.0.5 or later; vue-i18n (npm): upgrade to 9.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-52810 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-52810?** Check whether you run @intlify/shared (npm), @intlify/vue-i18n-core (npm), petite-vue-i18n (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @intlify/shared (npm): upgrade to 9.14.2 or later

  ```sh
  npm install @intlify/shared@9.14.2
  ```

- @intlify/vue-i18n-core (npm): upgrade to 9.14.2 or later

  ```sh
  npm install @intlify/vue-i18n-core@9.14.2
  ```

- petite-vue-i18n (npm): upgrade to 10.0.5 or later

  ```sh
  npm install petite-vue-i18n@10.0.5
  ```

- vue-i18n (npm): upgrade to 9.14.2 or later

  ```sh
  npm install vue-i18n@9.14.2
  ```


## Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in the deepCopy function of @intlify/shared versions 9.7.0–10.0.4. An attacker can craft a JSON payload containing __proto__ properties that, when passed to deepCopy, pollutes the Object.prototype chain with arbitrary properties. The attack requires no authentication and can be triggered via network with a malicious JSON input. While the minimum impact is denial of service (application instability), the severity escalates if polluted properties propagate to sensitive Node.js APIs such as exec or eval, potentially enabling remote code execution. Patches are available in versions 9.14.2, 10.0.5, and later.

## Affected products

- Intlify @intlify/shared 9.7.0–10.0.4
- Intlify @intlify/vue-i18n-core 9.7.0–10.0.4
- Intlify vue-i18n 9.7.0–10.0.4
- Intlify petite-vue-i18n 10.0.0–10.0.4

## Identifiers

- CVE-2024-52810
- GHSA-hjwq-mjwj-4x6c

## Timeline

- 2024-11-28: disclosed
- 2024-12-02: advisory

## References

- [https://github.com/intlify/vue-i18n/security/advisories/GHSA-hjwq-mjwj-4x6c](https://github.com/intlify/vue-i18n/security/advisories/GHSA-hjwq-mjwj-4x6c)

## Related threats

- [Vue I18n XSS in sanitizeTranslatedHtml srcdoc escaping](https://junglewise.ai/threats/cve-2026-118257-vue-i18n-is-the-internationalization-plugin-for-vue-js-from-11-1)
- [Vue I18n XSS in escapeParameter with named interpolation](https://junglewise.ai/threats/cve-2026-118256-vue-i18n-is-the-internationalization-plugin-for-vue-js-from-9-0)
- [vue-i18n escapeParameterHtml DOM-based XSS in tag attributes](https://junglewise.ai/threats/cve-2025-53892-vue-i18n-escapeparameterhtml-dom-based-xss-in-tag-attributes)
- [Intlify Vue I18n prototype pollution in handleFlatJson](https://junglewise.ai/threats/cve-2025-27597-intlify-vue-i18n-prototype-pollution-in-handleflatjson)
- [vue-i18n cross-site scripting with prototype pollution](https://junglewise.ai/threats/cve-2024-52809-vue-i18n-cross-site-scripting-with-prototype-pollution)