{"action":"Upgrade @intlify/vue-i18n-core to 9.14.5 or later.","affected":[{"fixed":"9.14.5","introduced":"9.2.0"},{"fixed":"10.0.8","introduced":"10.0.0"},{"fixed":"11.1.10","introduced":"11.0.0"}],"component":"@intlify/vue-i18n-core","cve_ids":["CVE-2025-53892"],"ecosystem":"npm","epss":0.00808,"exploited":false,"fixed_versions":["9.14.5","10.0.8","11.1.10"],"ghsa_id":"GHSA-x8qp-wqqm-57ph","id":"tcs_01M5KGHDGAZNBYWAE0ARAQQVVM","modified_at":"2026-09-10T03:50:57.972539838Z","published_at":"2025-07-16T19:32:48Z","references":["https://osv.dev/vulnerability/GHSA-x8qp-wqqm-57ph","https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph","https://nvd.nist.gov/vuln/detail/CVE-2025-53892","https://github.com/intlify/vue-i18n/pull/2229","https://github.com/intlify/vue-i18n/pull/2230","https://github.com/intlify/vue-i18n/commit/49f982443ab8fd94ecc427b265ce97d57df94d7e","https://github.com/intlify/vue-i18n/commit/a47099619fb9b256e86341a8658ebe72e92ab099","https://github.com/intlify/vue-i18n","https://github.com/intlify/vue-i18n/releases/tag/v10.0.8","https://github.com/intlify/vue-i18n/releases/tag/v11.1.10","https://github.com/intlify/vue-i18n/releases/tag/v9.14.5"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-x8qp-wqqm-57ph#npm/@intlify/vue-i18n-core","url":"https://osv.dev/vulnerability/GHSA-x8qp-wqqm-57ph"},{"source":"nvd","source_id":"CVE-2025-53892","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53892"}],"summary":"vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes"}