Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-52809
CVE-2024-52809:
JavaScript vulnerability analysis and mitigation
Overview
vue-i18n, an internationalization plugin for Vue.js, contains a Cross-site Scripting (XSS) vulnerability in versions 9.3.0 through 10.0.4. The vulnerability exists when locale messages are passed to createI18n or useI18n functions, where locale message ASTs (Abstract Syntax Trees) are generated in development mode, potentially enabling Cross-site Scripting attacks (GitHub Advisory).
Technical details
The vulnerability stems from the way vue-i18n handles AST generation for locale messages. The message compiler uses special properties for each node in the AST tree to optimize performance. While these optimizations are typically handled during production builds using @intlify/unplugin-vue-i18n, the development mode or custom implementations may be susceptible to prototype pollution attacks that could lead to XSS. The vulnerability has been assigned a CVSS v4.0 base score of 5.3 (Medium) with vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N (NVD).
Impact
If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript code through prototype pollution in the context of the web application using vue-i18n. This could potentially lead to theft of sensitive information, session hijacking, or other malicious actions within the user's browser context (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been patched in versions 9.14.2 and 10.0.5. For versions before 10.0.0, users can mitigate the vulnerability by disabling JIT compilation and using regular compilation instead (setting jit: false in the @intlify/unplugin-vue-i18n plugin configuration). Users are advised to upgrade to the patched versions (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management