CVE-2025-27597: Vue I18n Prototype Pollution Vulnerability

CVE-2025-27597 Overview

CVE-2025-27597 is a Prototype Pollution vulnerability affecting Vue I18n, the internationalization plugin for Vue.js. The @intlify/message-resolver and @intlify/vue-i18n-core packages are vulnerable through the handleFlatJson entry function. An attacker can supply a malicious payload using Object.prototype setter to introduce or modify properties within the global prototype chain, resulting in denial of service (DoS) at minimum and potentially escalating to more severe injection-based attacks.

Critical Impact

This vulnerability allows attackers to pollute the JavaScript prototype chain, which can lead to denial of service or, depending on application context, remote code execution if polluted properties propagate to sensitive Node.js APIs such as exec or eval.

Affected Products

• @intlify/message-resolver (Vue I18n component)
• @intlify/vue-i18n-core (Vue I18n component)
• Vue I18n internationalization plugin for Vue.js

Discovery Timeline

• 2025-03-07 - CVE-2025-27597 published to NVD
• 2025-03-07 - Last updated in NVD database

Technical Details for CVE-2025-27597

Vulnerability Analysis

This Prototype Pollution vulnerability exists in the handleFlatJson function within the Vue I18n library. Prototype Pollution is a JavaScript-specific vulnerability that occurs when an application allows modification of the base object prototype through user-controlled input. In this case, the vulnerable function fails to properly validate object keys before assignment, allowing attackers to inject properties into Object.prototype via specially crafted input containing __proto__ keys.

The vulnerability is classified under CWE-1321 (Improper Neutralization of Special Elements in Data Query Logic). When exploited, the attack can propagate polluted properties throughout the application's JavaScript runtime environment, affecting all objects that inherit from Object.prototype.

Root Cause

The root cause of this vulnerability lies in the handleFlatJson function's failure to sanitize or block dangerous keys like __proto__ when processing nested object structures. The function iteratively constructs nested objects from flattened JSON keys without checking whether those keys could target the prototype chain, allowing attackers to inject malicious properties into the global object prototype.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this vulnerability by supplying JSON data with maliciously crafted keys containing __proto__ segments. When the handleFlatJson function processes this input, it traverses the key path and inadvertently sets properties on Object.prototype instead of a legitimate object property.

The consequences can range from denial of service (crashing the application or causing unexpected behavior) to remote code execution if the application uses the polluted properties in sensitive operations such as command execution (exec), code evaluation (eval), or other dangerous Node.js APIs.

       let currentObj = obj
       let hasStringValue = false
       for (let i = 0; i < lastIndex; i++) {
+        if (subKeys[i] === '__proto__') {
+          throw new Error(`unsafe key: ${subKeys[i]}`)
+        }
         if (!(subKeys[i] in currentObj)) {
           currentObj[subKeys[i]] = create()
         }

Source: GitHub Commit Update

Detection Methods for CVE-2025-27597

Indicators of Compromise

• Unexpected application crashes or behavior changes related to object property access
• Log entries showing errors related to prototype or property access on base objects
• Unusual JSON payloads containing __proto__, constructor, or prototype key segments in application inputs
• Application instability following processing of internationalization data

Detection Strategies

• Implement input validation rules to detect and block JSON keys containing __proto__, constructor, or prototype strings
• Monitor application logs for errors related to unexpected property types or prototype chain modifications
• Deploy runtime application self-protection (RASP) solutions to detect prototype pollution attempts
• Use static analysis tools to identify vulnerable patterns in JavaScript/TypeScript code

Monitoring Recommendations

• Enable verbose logging for Vue I18n operations to capture suspicious input patterns
• Monitor for anomalous application behavior following i18n data processing
• Implement alerting on repeated application crashes or restarts that may indicate exploitation attempts
• Review audit logs for any requests containing suspicious JSON structures targeting prototype properties

How to Mitigate CVE-2025-27597

Immediate Actions Required

• Update @intlify/message-resolver and @intlify/vue-i18n-core packages to the patched versions immediately
• Audit application code for any custom implementations that process nested JSON without key sanitization
• Implement input validation to reject JSON payloads containing __proto__ or similar dangerous keys
• Review application integration points where Vue I18n processes external input

Patch Information

The vulnerability has been addressed in commit 4bb6eacda7fc2cde5687549afa0efb27ca40862a. The fix adds explicit validation to reject __proto__ keys in the handleFlatJson function, throwing an error when unsafe keys are detected. Organizations should update to the patched version as documented in the GitHub Security Advisory.

Workarounds

• Implement application-level input validation to sanitize JSON keys before passing to Vue I18n functions
• Use a JSON parser wrapper that strips or rejects keys containing prototype-related strings
• Deploy a Web Application Firewall (WAF) rule to block requests containing __proto__ patterns in JSON bodies
• Isolate i18n processing in a sandboxed environment to limit the impact of prototype pollution

# Update Vue I18n packages to patched versions
npm update @intlify/vue-i18n-core @intlify/message-resolver

# Or install specific patched version
npm install @intlify/vue-i18n-core@latest @intlify/message-resolver@latest

# Verify installed versions
npm list @intlify/vue-i18n-core @intlify/message-resolver