vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibility of Cross-site Scripting attack. This issue has been addressed in versions 9.14.2, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| @intlify/core-base(npm) | 9.3.0 | 9.14.2 | N/A |
| vue-i18n(npm) | 9.3.0 | 9.14.2 | N/A |
| @intlify/core(npm) | 9.3.0 | 9.14.2 | N/A |
| @intlify/vue-i18n-core(npm) | 9.3.0 | 9.14.2 | N/A |
| petite-vue-i18n(npm) | 10.0.0 | 10.0.5 | N/A |
| @intlify/core-base(npm) | 10.0.0 | 10.0.5 | N/A |
| vue-i18n(npm) | 10.0.0 | 10.0.5 | N/A |
| @intlify/core(npm) | 10.0.0 | 10.0.5 | N/A |
| @intlify/vue-i18n-core(npm) | 10.0.0 | 10.0.5 | N/A |
CVSS Metrics
