What’s Vulnerable › Vulnerabilities

CVE-2024-52809: Cross-site Scripting vulnerability with prototype pollution in vue-i18n

• Severity: medium (CVSS 5.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-29 · updated 2026-06-17
• Weakness: CWE-79

Description

vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibility of Cross-site Scripting attack. This issue has been addressed in versions 9.14.2, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• intlify vue-i18n: from 9.3.0 before 9.14.2; from 10.0.0 before 10.0.5 — fixed in 10.0.5, 9.14.2

How to fix

Upgrade to a fixed version: intlify vue-i18n 10.0.5, 9.14.2. Check the vendor advisory for mitigations.

References

• https://github.com/intlify/vue-i18n/commit/72f0d323006fc7363b18cab62d4522dadd874411
• https://github.com/intlify/vue-i18n/commit/9f20909ef8c9232a1072d7818e12ed6d6451024d
• https://github.com/intlify/vue-i18n/security/advisories/GHSA-9r9m-ffp6-9x4v

Get alerted when CVE-2024-52809 or the next vulnerability affects your stack