XSS in Intlify Vue-I18n

CVE-2024-52809

vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibility of Cross-site Scripting attack. This issue has been addressed in versions 9.14.2, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.006 (47.3th percentile) — read the EPSS interpretation.

Affected products

Intlify Vue-i18n — versions < 9.14.2, >= 10.0.0, < 10.0.5

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)