npm/@intlify/vue-i18n-core CVE-2025-53892: medium 5.3, EPSS 0.81%

vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes

Action: Upgrade @intlify/vue-i18n-core to 9.14.5 or later.

npm i @intlify/vue-i18n-core@9.14.5

npm i @intlify/vue-i18n-core@10.0.8

npm i @intlify/vue-i18n-core@11.1.10

Affected

Fixed versions

Sources

• osv: GHSA-x8qp-wqqm-57ph#npm/@intlify/vue-i18n-core
• nvd: CVE-2025-53892
• https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph
• https://github.com/intlify/vue-i18n/pull/2229
• https://github.com/intlify/vue-i18n/pull/2230
• https://github.com/intlify/vue-i18n/commit/49f982443ab8fd94ecc427b265ce97d57df94d7e
• https://github.com/intlify/vue-i18n/commit/a47099619fb9b256e86341a8658ebe72e92ab099
• https://github.com/intlify/vue-i18n
• https://github.com/intlify/vue-i18n/releases/tag/v10.0.8
• https://github.com/intlify/vue-i18n/releases/tag/v11.1.10
• https://github.com/intlify/vue-i18n/releases/tag/v9.14.5

CVE-2025-53892 · published 2025-07-16T19:32:48Z · modified 2026-09-10T03:50:57.972539838Z · JSON