npm/@intlify/message-resolver CVE-2025-27597: high 8.9, EPSS 0.63%

Vue I18n Allows Prototype Pollution in `handleFlatJson`

Action: Upgrade @intlify/message-resolver to 9.1.11 or later.

npm i @intlify/message-resolver@9.1.11

Affected

Fixed versions

Sources

• osv: GHSA-p2ph-7g93-hw3m
• nvd: CVE-2025-27597
• https://github.com/intlify/vue-i18n/security/advisories/GHSA-p2ph-7g93-hw3m
• https://github.com/intlify/vue-i18n/commit/4bb6eacda7fc2cde5687549afa0efb27ca40862a
• https://github.com/intlify/vue-i18n/commit/d21e06a7440eed8ada7f522b22fcf830b98d3a53
• https://github.com/intlify/vue-i18n/commit/fbda9988d3ddd3a1a21740d506d2c183d6b6e36a
• https://github.com/intlify/vue-i18n/commit/feaf13fcff427f2cb1d5ec8076e639506ba28f9e
• https://github.com/intlify/vue-i18n
• https://github.com/intlify/vue-i18n/releases/tag/v10.0.6
• https://github.com/intlify/vue-i18n/releases/tag/v11.1.2
• https://github.com/intlify/vue-i18n/releases/tag/v9.14.3

CVE-2025-27597 · published 2025-03-07T15:58:24Z · modified 2026-08-26T01:21:39.693367499Z · JSON