Detections
Analytics
SCA: security update for @intlify/core, @intlify/core-base, @intlify/vue-i18n-core, petite-vue-i18n, vue-i18n (GHSA-8rc2-428q-7ww3)
low Tenable Cloud Security Plugin ID 477822
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and
12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape
named interpolation values when the same translation call supplies both list and named values because
escapeParams() processes only the list branch. Applications that render translations as HTML and pass
untrusted named values with a list can insert attacker-controlled markup, including phishing links, forms,
and layout changes, and can permit script execution when combined with the srcdoc sanitizer bypass or on
releases without the sanitizer. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.
(CVE-2026-118256)
Solution
Update the @intlify/core library and its related packages to version 11.4.14 or later.See Also
Plugin Details
Severity: Low
ID: 477822
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 10/29/2026
Updated: 10/29/2026
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.54
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2026-118256
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Low
Base Score: 2.1
Threat Score: 0.5
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/28/2026
Vulnerability Publication Date: 10/28/2026
Reference Information
CVE: CVE-2026-118256