tocsin

npm/@intlify/core CVE-2025-53892: medium 5.3, EPSS 0.81%

vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes

Action: Upgrade @intlify/core to 9.14.5 or later.

npm i @intlify/core@9.14.5
npm i @intlify/core@10.0.8
npm i @intlify/core@11.1.10

Affected

introducedfixedlast affected
9.0.09.14.5-
10.0.010.0.8-
11.0.011.1.10-

Fixed versions

9.14.510.0.811.1.10

Sources

CVE-2025-53892 · published · modified · JSON