{"action":"Upgrade petite-vue-i18n to 10.0.8 or later.","affected":[{"fixed":"10.0.8","introduced":"10.0.0"},{"fixed":"11.1.10","introduced":"11.0.0"}],"component":"petite-vue-i18n","cve_ids":["CVE-2025-53892"],"ecosystem":"npm","epss":0.00808,"exploited":false,"fixed_versions":["10.0.8","11.1.10"],"ghsa_id":"GHSA-x8qp-wqqm-57ph","id":"tcs_01M5KGHDPN5N7BAFNSPJ1SJD8B","modified_at":"2026-09-10T03:50:57.972539838Z","published_at":"2025-07-16T19:32:48Z","references":["https://osv.dev/vulnerability/GHSA-x8qp-wqqm-57ph","https://github.com/intlify/vue-i18n/security/advisories/GHSA-x8qp-wqqm-57ph","https://nvd.nist.gov/vuln/detail/CVE-2025-53892","https://github.com/intlify/vue-i18n/pull/2229","https://github.com/intlify/vue-i18n/pull/2230","https://github.com/intlify/vue-i18n/commit/49f982443ab8fd94ecc427b265ce97d57df94d7e","https://github.com/intlify/vue-i18n/commit/a47099619fb9b256e86341a8658ebe72e92ab099","https://github.com/intlify/vue-i18n","https://github.com/intlify/vue-i18n/releases/tag/v10.0.8","https://github.com/intlify/vue-i18n/releases/tag/v11.1.10","https://github.com/intlify/vue-i18n/releases/tag/v9.14.5"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-x8qp-wqqm-57ph#npm/petite-vue-i18n","url":"https://osv.dev/vulnerability/GHSA-x8qp-wqqm-57ph"}],"summary":"vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes"}