Description
vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibility of Cross-site Scripting attack. This issue has been addressed in versions 9.14.2, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| intlify | vue-i18n | < 9.14.2, >= 10.0.0, < 10.0.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @intlify/core | >= 9.3.0, < 9.14.2 | 9.14.2 | GHSA-9r9m-ffp6-9x4v |
| npm | @intlify/core | >= 10.0.0, < 10.0.5 | 10.0.5 | GHSA-9r9m-ffp6-9x4v |
| npm | @intlify/core-base | >= 9.3.0, < 9.14.2 | 9.14.2 | GHSA-9r9m-ffp6-9x4v |
| npm | @intlify/core-base | >= 10.0.0, < 10.0.5 | 10.0.5 | GHSA-9r9m-ffp6-9x4v |
| npm | @intlify/vue-i18n-core | >= 9.3.0, < 9.14.2 | 9.14.2 | GHSA-9r9m-ffp6-9x4v |
| npm | @intlify/vue-i18n-core | >= 10.0.0, < 10.0.5 | 10.0.5 | GHSA-9r9m-ffp6-9x4v |
| npm | petite-vue-i18n | >= 10.0.0, < 10.0.5 | 10.0.5 | GHSA-9r9m-ffp6-9x4v |
| npm | vue-i18n | >= 9.3.0, < 9.14.2 | 9.14.2 | GHSA-9r9m-ffp6-9x4v |
| npm | vue-i18n | >= 10.0.0, < 10.0.5 | 10.0.5 | GHSA-9r9m-ffp6-9x4v |