Is CVE-2026-118257 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118257 being exploited in the wild.

How severe is CVE-2026-118257?

High severity, with a CVSS score of 7.2, published 28 October 2026.

Which products and versions are affected?

Intlify Vue I18n 9.14.5, 10.0.8, 11.1.10 to 11.4.13, 12.0.0-alpha.4; @intlify/core (npm) = 9.14.5, SEMVER:introduced=11.1.10,fixed=11.4.14; @intlify/core-base (npm) = 9.14.5, SEMVER:introduced=11.1.10,fixed=11.4.14; @intlify/shared (npm) = 9.14.5, SEMVER:introduced=11.1.10,fixed=11.4.14; and 3 more.

Is there a fix for CVE-2026-118257?

Yes. @intlify/core (npm): upgrade to 11.4.14 or later; @intlify/core-base (npm): upgrade to 11.4.14 or later; @intlify/shared (npm): upgrade to 11.4.14 or later; @intlify/vue-i18n-core (npm): upgrade to 11.4.14 or later; petite-vue-i18n (npm): upgrade to 11.4.14 or later; vue-i18n (npm): upgrade to 11.4.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118257 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118257?

Check whether you run Intlify Vue I18n, @intlify/core (npm), @intlify/core-base (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118257: Vue I18n XSS in sanitizeTranslatedHtml srcdoc escaping

CVE-2026-118257 · Severity: high · CVSS 7.2 · Published 2026-10-28

Vue I18n is a localization library for Vue.js applications that manages translated text across different languages. The sanitizeTranslatedHtml function fails to properly neutralize the srcdoc attribute when escaping HTML content, allowing attackers to inject and execute malicious scripts when applications render translations as HTML. This affects applications using the escapeParameter feature to process user-controlled translation data.

Technologies: @intlify/core (npm), @intlify/core-base (npm), @intlify/vue-i18n-core (npm), petite-vue-i18n (npm), vue-i18n (npm). Vendors: Intlify, npm.

Quick answers

Is CVE-2026-118257 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118257 being exploited in the wild.
How severe is CVE-2026-118257?: High severity, with a CVSS score of 7.2, published 28 October 2026.
Which products and versions are affected?: Intlify Vue I18n 9.14.5, 10.0.8, 11.1.10 to 11.4.13, 12.0.0-alpha.4; @intlify/core (npm) = 9.14.5, SEMVER:introduced=11.1.10,fixed=11.4.14; @intlify/core-base (npm) = 9.14.5, SEMVER:introduced=11.1.10,fixed=11.4.14; @intlify/shared (npm) = 9.14.5, SEMVER:introduced=11.1.10,fixed=11.4.14; and 3 more.
Is there a fix for CVE-2026-118257?: Yes. @intlify/core (npm): upgrade to 11.4.14 or later; @intlify/core-base (npm): upgrade to 11.4.14 or later; @intlify/shared (npm): upgrade to 11.4.14 or later; @intlify/vue-i18n-core (npm): upgrade to 11.4.14 or later; petite-vue-i18n (npm): upgrade to 11.4.14 or later; vue-i18n (npm): upgrade to 11.4.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118257 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118257?: Check whether you run Intlify Vue I18n, @intlify/core (npm), @intlify/core-base (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@intlify/core (npm): upgrade to 11.4.14 or later
```
npm install @intlify/core@11.4.14
```
@intlify/core-base (npm): upgrade to 11.4.14 or later
```
npm install @intlify/core-base@11.4.14
```
@intlify/shared (npm): upgrade to 11.4.14 or later
```
npm install @intlify/shared@11.4.14
```
@intlify/vue-i18n-core (npm): upgrade to 11.4.14 or later
```
npm install @intlify/vue-i18n-core@11.4.14
```
petite-vue-i18n (npm): upgrade to 11.4.14 or later
```
npm install petite-vue-i18n@11.4.14
```
vue-i18n (npm): upgrade to 11.4.14 or later
```
npm install vue-i18n@11.4.14
```

Technical details

The vulnerability is a cross-site scripting (XSS) flaw in sanitizeTranslatedHtml() where the srcdoc attribute is escaped but remains active; browsers decode the character references and parse the value as a same-origin nested HTML document, enabling script execution. The issue occurs when attacker-controlled parameters or translation content is rendered as HTML via v-html with escapeParameter enabled. Applications using the i18n-t rendering component are not affected; versions 9.14.5, 10.0.8, 11.1.10 through 11.4.14, and 12.0.0-alpha.4 through 12.0.0-alpha.5 are vulnerable.

Affected products

Intlify Vue I18n 9.14.5, 10.0.8, 11.1.10 to 11.4.13, 12.0.0-alpha.4

Identifiers

CVE-2026-118257
GHSA-83rm-6c8r-g728

Timeline

2026-10-28: disclosed
2026-10-10: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.