CVE-2025-53892: 
JavaScript vulnerability analysis and mitigation

CVE-2025-53892 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Vue I18n, the internationalization plugin for Vue.js. The flaw exists in the escapeParameterHtml: true security option, which fails to prevent execution of tag-based XSS payloads (e.g., <img src=x onerror=...>) when translated strings containing HTML are rendered via Vue's v-html directive. It affects vue-i18n, @intlify/core, @intlify/core-base, @intlify/vue-i18n-core, and petite-vue-i18n packages starting from version 9.0.0, prior to patched versions 9.14.5, 10.0.8, and 11.1.0. Disclosed on July 16, 2025, it carries a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is improper neutralization of input during web page generation (CWE-79). While escapeParameterHtml: true correctly escapes common HTML special characters in interpolated parameters, it does not sanitize entire HTML attribute contexts within the final translated string. As a result, if a translation message template itself contains HTML markup (e.g., 'Caution: <img src=x {payload}>') and the output is rendered via v-html, an attacker-controlled interpolation value can inject event handler attributes like onerror=alert("xss") or javascript: URLs that execute in the browser. The fix introduced a new sanitizeTranslatedHtml() function in @intlify/shared that post-processes the translated output to neutralize event handler attributes (e.g., onclick, onerror) and disable javascript: URL schemes in href, src, action, formaction, and style attributes (GitHub Advisory, Fix PR #2229, Fix Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session, enabling session hijacking, credential theft, phishing, or unauthorized actions on behalf of the user. The vulnerability is client-side only and does not directly affect server confidentiality, integrity, or availability; however, it can be leveraged for significant client-side attacks against end users of Vue.js applications that use Vue I18n with HTML-containing translation strings rendered via v-html. The impact is limited to the browser context of users who visit affected pages, with no direct lateral movement to backend systems (GitHub Advisory).

1. Identify a target application: Find a Vue.js application using Vue I18n (versions 9.0.0–9.14.4, 10.0.0–10.0.7, or 11.0.0–11.0.x) with escapeParameterHtml: true configured.
2. Locate vulnerable translation usage: Identify pages where translation strings containing HTML are rendered via v-html and where interpolation parameters are derived from user-controlled input (e.g., URL parameters, form fields, or user profile data).
3. Craft a malicious payload: Prepare an interpolation value that injects an event handler attribute, such as alert("xss") intended to be placed as the value of an onerror attribute within an existing HTML tag in the translation string.
4. Deliver the payload: Supply the crafted value as the interpolation parameter — for example, via a URL query string or any other input vector that feeds into the translation call.
5. Trigger execution: When the victim's browser renders the page, the v-html directive inserts the unsanitized translated HTML into the DOM, causing the injected event handler (e.g., onerror) to fire and execute the attacker's JavaScript (GitHub Advisory, Fix PR #2229).

• Network: Unusual outbound requests from user browsers to attacker-controlled domains following page loads of Vue.js application pages that use v-html with translated content; unexpected fetch or XMLHttpRequest calls to external endpoints originating from the application's origin.
• Logs: Web server access logs showing requests with encoded HTML payloads (e.g., %3Cimg, onerror, javascript%3A) in query parameters or POST bodies that correspond to translation interpolation inputs.
• Browser/Client-Side: Browser console errors or warnings referencing Vue I18n's sanitizeTranslatedHtml function (in patched versions); Content Security Policy (CSP) violation reports triggered by inline event handler execution attempts.

Upgrade to the patched versions of the affected packages: vue-i18n, @intlify/core, @intlify/core-base, @intlify/vue-i18n-core to 9.14.5, 10.0.8, or 11.1.0 (or later); petite-vue-i18n to 10.0.8 or 11.1.0 (GitHub Advisory). As interim workarounds: avoid using v-html to render translation strings that contain HTML markup; validate and sanitize all translation strings for XSS payloads; avoid accepting user-controlled data as interpolation parameters in HTML-containing translations; and implement a strict Content Security Policy (CSP) that disallows inline event handlers (unsafe-inline) to reduce the impact of any successful injection.

The vulnerability was disclosed and patched by Vue I18n maintainer kazupon (Kazuya Kawaguchi) on July 16, 2025, with fixes merged simultaneously for the v9 and v10 branches (Fix PR #2229, Fix PR #2230). The CVE appeared in trending CVE lists on Reddit's r/CVEWatch community in May 2026, suggesting ongoing awareness in the security community. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability database entries.