CVE-2025-53892: Vue I18n XSS Vulnerability

CVE-2025-53892 Overview

CVE-2025-53892 is a DOM-based Cross-Site Scripting (XSS) vulnerability [CWE-79] in Vue I18n, the internationalization plugin for Vue.js. The escapeParameterHtml: true option is designed to prevent HTML and script injection by escaping interpolated parameters. Starting in version 9.0.0 and prior to 9.14.5, 10.0.8, and 11.1.0, this option fails to block tag-based payloads such as <img src=x onerror=...> when the interpolated value is rendered through v-html. Applications that combine translated strings containing minor HTML with v-html rendering can execute attacker-controlled JavaScript in the browser context.

Critical Impact
Attacker-controlled interpolation values can trigger JavaScript execution in the user's browser session despite the escapeParameterHtml mitigation being enabled.

Affected Products

Vue I18n versions 9.0.0 through 9.14.4
Vue I18n versions 10.0.0 through 10.0.7
Vue I18n versions 11.0.0 through 11.0.x prior to 11.1.0

Discovery Timeline

2025-07-16 - CVE-2025-53892 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53892

Vulnerability Analysis

Vue I18n exposes an escapeParameterHtml option intended to escape HTML metacharacters in interpolated parameters before rendering. The escaping routine handles core HTML delimiters such as <, >, &, and quotes but does not neutralize event-handler attributes or tag structures that may already exist in the translation source string. When a developer stores a translation string containing benign HTML and renders it via Vue's v-html directive, the browser parses the composite output. An attacker who controls an interpolated parameter can inject payloads like <img src=x onerror=alert(1)> that execute as DOM script content.

The vulnerability is scoped to applications that both enable escapeParameterHtml: true and pass translation output through v-html. It falls under [CWE-79] and requires user interaction, such as visiting a page rendering an attacker-influenced translation parameter. The EPSS score is 0.676% (48.5th percentile).

Root Cause

The escaping helper in packages/shared/src/utils.ts and the translation pipeline in packages/core-base/src/translate.ts escaped only character-level HTML metacharacters. They did not sanitize the fully composed translated string when that string was intended for HTML sinks. The maintainers introduced a new sanitizeTranslatedHtml helper to enforce sanitization on translated output routed to HTML contexts.

Attack Vector

An attacker crafts input to a parameter that is later passed to $t() or t() and rendered via v-html. The translation template supplies harmless surrounding HTML while the escaped parameter still permits tag attributes to be assembled at parse time, allowing execution of onerror, onload, and similar event handlers.

typescript

// packages/core-base/src/translate.ts (patch excerpt)
   generateFormatCacheKey,
   generateCodeFrame,
   escapeHtml,
+  sanitizeTranslatedHtml,
   inBrowser,
   warn,
   mark,

Source: GitHub commit a4709961

typescript

// packages/shared/src/utils.ts (patch excerpt)
  * written by kazuya kawaguchi
  */
 
+import { warn } from './warn'
+
 export const inBrowser = typeof window !== 'undefined'
 
 export let mark: (tag: string) => void | undefined

Source: GitHub commit 49f98244

Detection Methods for CVE-2025-53892

Indicators of Compromise

Client-side JavaScript errors or unexpected script execution originating from translation strings rendered by v-html.
Requests containing tag-based payloads such as <img src=x onerror=, <svg onload=, or <iframe srcdoc= in URL parameters, form fields, or user-profile data reflected into translations.
Content Security Policy (CSP) violation reports referencing inline event handlers on pages using Vue I18n.

Detection Strategies

Inventory Vue.js applications and identify usage of vue-i18n at versions below 9.14.5, 10.0.8, or 11.1.0 with escapeParameterHtml: true combined with v-html sinks.
Perform static analysis for v-html bindings receiving output from $t() or t() calls that accept untrusted parameters.
Add dynamic application security testing (DAST) payloads targeting translation parameters with tag-based XSS vectors.

Monitoring Recommendations

Deploy CSP with script-src restrictions and enable violation reporting to surface injected event handlers.
Monitor web application firewall (WAF) logs for XSS-shaped payloads targeting endpoints that feed localization parameters.
Correlate browser telemetry with server-side inputs to identify reflected translation content originating from untrusted sources.

How to Mitigate CVE-2025-53892

Immediate Actions Required

Upgrade vue-i18n to version 9.14.5, 10.0.8, or 11.1.0 (or later, including 11.1.10) as appropriate for your major version branch.
Audit all templates for v-html usage that consumes translated strings and refactor to use text interpolation ({{ }}) where HTML is not required.
Treat any user-controllable parameter passed into translation functions as untrusted and sanitize server-side before storage.

Patch Information

The fix is delivered in Vue I18n v9.14.5, v10.0.8, and v11.1.10. The patches introduce a sanitizeTranslatedHtml helper and are tracked in Pull Request #2229 and Pull Request #2230. Full details are available in GHSA-x8qp-wqqm-57ph.

Workarounds

Remove v-html bindings that render translated content and switch to standard text interpolation.
Sanitize translation parameters with a dedicated HTML sanitizer such as DOMPurify before passing them to $t().
Enforce a strict Content Security Policy that disallows inline event handlers and unsafe-inline scripts.

bash

# Upgrade Vue I18n to a patched release
npm install vue-i18n@^9.14.5
# or
npm install vue-i18n@^10.0.8
# or
npm install vue-i18n@^11.1.10