# CVE-2026-118256: Vue I18n XSS in escapeParameter with named interpolation

Source: https://junglewise.ai/threats/cve-2026-118256-vue-i18n-is-the-internationalization-plugin-for-vue-js-from-9-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118256 · Severity: medium · CVSS 4 · Published 2026-10-28

Vue I18n is a plugin that translates text in Vue.js applications. When the escapeParameter security feature is enabled, it fails to escape untrusted named values if the same translation includes both list and named values, allowing attackers to inject malicious HTML and JavaScript that could steal data, redirect users, or execute arbitrary code.

Technologies: [@intlify/core (npm)](https://junglewise.ai/threats/technologies/intlify-core), [@intlify/core-base (npm)](https://junglewise.ai/threats/technologies/intlify-core-base), [@intlify/vue-i18n-core (npm)](https://junglewise.ai/threats/technologies/intlify-vue-i18n-core), [petite-vue-i18n (npm)](https://junglewise.ai/threats/technologies/petite-vue-i18n), [vue-i18n (npm)](https://junglewise.ai/threats/technologies/vue-i18n). Vendors: [Intlify](https://junglewise.ai/threats/vendors/intlify), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-118256 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118256 being exploited in the wild.

**How severe is CVE-2026-118256?** Medium severity, with a CVSS score of 4, published 28 October 2026.

**Which products and versions are affected?** Intlify Vue I18n 9.0.0-beta.5 through 11.4.13; 12.0.0-alpha.5 through 12.0.0-beta.0; @intlify/core (npm) >= 9.0.0-beta.10, < 11.4.14, SEMVER:introduced=9.0.0-beta.10,fixed=11.4.14; @intlify/core-base (npm) >= 9.0.0-beta.12, < 11.4.14, SEMVER:introduced=9.0.0-beta.12,fixed=11.4.14; @intlify/vue-i18n-core (npm) >= 9.2.0-alpha.7, < 11.4.14, SEMVER:introduced=9.2.0-alpha.7,fixed=11.4.14; and 2 more.

**Is there a fix for CVE-2026-118256?** Yes. @intlify/core (npm): upgrade to 11.4.14 or later; @intlify/core-base (npm): upgrade to 11.4.14 or later; @intlify/vue-i18n-core (npm): upgrade to 11.4.14 or later; petite-vue-i18n (npm): upgrade to 11.4.14 or later; vue-i18n (npm): upgrade to 11.4.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118256 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118256?** Check whether you run Intlify Vue I18n, @intlify/core (npm), @intlify/core-base (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @intlify/core (npm): upgrade to 11.4.14 or later

  ```sh
  npm install @intlify/core@11.4.14
  ```

- @intlify/core-base (npm): upgrade to 11.4.14 or later

  ```sh
  npm install @intlify/core-base@11.4.14
  ```

- @intlify/vue-i18n-core (npm): upgrade to 11.4.14 or later

  ```sh
  npm install @intlify/vue-i18n-core@11.4.14
  ```

- petite-vue-i18n (npm): upgrade to 11.4.14 or later

  ```sh
  npm install petite-vue-i18n@11.4.14
  ```

- vue-i18n (npm): upgrade to 11.4.14 or later

  ```sh
  npm install vue-i18n@11.4.14
  ```


## Technical details

The escapeParams() function uses a conditional branch (if/else if) that processes only list values or named values, but not both when both are supplied in a single translation call. This allows named parameter values to bypass HTML escaping when a list is also present. An attacker can supply untrusted named values that will be rendered as unescaped HTML if the application passes both list and named interpolations to the same translation, potentially enabling stored or reflected XSS.

## Affected products

- intlify Vue I18n 9.0.0-beta.5 through 11.4.13; 12.0.0-alpha.5 through 12.0.0-beta.0

## Identifiers

- CVE-2026-118256
- GHSA-8rc2-428q-7ww3

## Timeline

- 2026-10-28: disclosed

## References

- [https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8](https://github.com/intlify/vue-i18n/commit/d657ce8f4b3b6b198a8f6e3d09e2b57a5d019fb8)
- [https://github.com/intlify/vue-i18n/pull/2680](https://github.com/intlify/vue-i18n/pull/2680)

## Related threats

- [Vue I18n XSS in sanitizeTranslatedHtml srcdoc escaping](https://junglewise.ai/threats/cve-2026-118257-vue-i18n-is-the-internationalization-plugin-for-vue-js-from-11-1)
- [vue-i18n escapeParameterHtml DOM-based XSS in tag attributes](https://junglewise.ai/threats/cve-2025-53892-vue-i18n-escapeparameterhtml-dom-based-xss-in-tag-attributes)
- [Intlify Vue I18n prototype pollution in handleFlatJson](https://junglewise.ai/threats/cve-2025-27597-intlify-vue-i18n-prototype-pollution-in-handleflatjson)
- [Intlify shared prototype pollution in deepCopy](https://junglewise.ai/threats/cve-2024-52810-intlify-shared-prototype-pollution-in-deepcopy)
- [vue-i18n cross-site scripting with prototype pollution](https://junglewise.ai/threats/cve-2024-52809-vue-i18n-cross-site-scripting-with-prototype-pollution)