CVE-2025-53892

Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, starting in version 9.0.0 and prior to versions 9.14.5, 10.0.8, and 11.1.0, this setting fails to prevent execution of certain tag-based payloads, such as <img src=x onerror=...>, if the interpolated value is inserted inside an HTML context using v-html. This may lead to a DOM-based XSS vulnerability, even when using escapeParameterHtml: true, if a translation string includes minor HTML and is rendered via v-html. Versions 9.14.5, 10.0.8, and 11.1.0 contain a fix for the issue.

• CWE-79

• https://github.com/intlify/vue-i18n/commit/49f982443ab8fd94ecc427b265ce97d57df94d7e
• https://github.com/intlify/vue-i18n/commit/a47099619fb9b256e86341a8658ebe72e92ab099
• https://github.com/intlify/vue-i18n/pull/2229
• https://github.com/intlify/vue-i18n/pull/2230
• https://github.com/intlify/vue-i18n/releases/tag/v10.0.8
• https://github.com/intlify/vue-i18n/releases/tag/v11.1.10
• https://github.com/intlify/vue-i18n/releases/tag/v9.14.5
• https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph
• https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph

Published

Jul 16, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-53887Directus is a real-time API and App dashboard for managing S…5.3
• CVE-2025-53888RIOT-OS, an operating system that supports Internet of Thing…9.8
• CVE-2025-53889Directus is a real-time API and App dashboard for managing S…6.5
• CVE-2025-5389A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-53890pyload is an open-source Download Manager written in pure Py…9.8
• CVE-2025-53891The timelineofficial/Time-Line- repository contains the sour…4.3
• CVE-2025-53893File Browser provides a file managing interface within a spe…6.5
• CVE-2025-53895ZITADEL is an open source identity management system. Starti…8.8
• CVE-2025-53896Kiteworks MFT orchestrates end-to-end file transfer workflow…8.1
• CVE-2025-53897Kiteworks MFT orchestrates end-to-end file transfer workflow…6.8
• CVE-2025-53899Kiteworks MFT orchestrates end-to-end file transfer workflow…7.2
• CVE-2025-5390A vulnerability, which was classified as critical, was found…9.8