GHSA-473g-cvf6-mfxj: 
JavaScript vulnerability analysis and mitigation

Summary

When escapeParameter is enabled (escapeParameterHtml in the Legacy API), Vue I18n passes the translated string through sanitizeTranslatedHtml(). The sanitizer replaces javascript: URLs in href, src, action and formaction with about:blank, but an SVG link can get a javascript: URL in two ways that the sanitizer does not check:

• the xlink:href attribute, the older spelling of href that an SVG <a> still follows, and
• the SVG animation elements <animate> and <set>, which can set href of an SVG <a> through values or to. When a user clicks such a link, the script runs in the origin of the application. This bypasses the javascript: URL check that the sanitizer has had since the fix for CVE-2025-53892 (GHSA-x8qp-wqqm-57ph).

Details

sanitizeTranslatedHtml() (packages/shared/src/sanitize.ts in v11.4.16) checks for javascript: URLs in two places:

1. In quoted attribute values, only when the whole attribute name is href, src, action or formaction.
2. In unquoted attribute values, only when one of these names comes after whitespace, a quote, <, > or /.

xlink:href passes both checks: its name is not in the list, and in the unquoted form, href comes after :. Escaping the value does not help, since the browser decodes character references in attribute values before it uses them as URLs. <animate attributeName="href" values="javascript:..."> and <set attributeName="href" to="javascript:..."> set href of the parent <a> after the HTML is rendered. values and to are not URL attributes, so the sanitizer does not look at them. The maintainers found this variant while fixing the xlink:href report. This can be reached in two ways:

• Markup in a message. A message that contains such an SVG link keeps it after sanitizing. The documentation asks not to use HTML messages with content from users, but it also says that the sanitizer disables javascript: URLs in the final HTML.
• A parameter inside xlink:href. With a message such as <svg><a xlink:href="{url}">...</a></svg>, escapeParameter escapes url, but escaping does not change a javascript: scheme.

PoC

import { createI18n } from 'vue-i18n'
const i18n = createI18n({
  legacy: false,
  locale: 'en',
  escapeParameter: true,
  messages: {
    en: {
      xlink: '<svg><a xlink:href="javascript:alert(1)"><text y="20">click</text></a></svg>',
      animation:
        '<svg><a><set attributeName="href" to="javascript:alert(1)"/><text y="20">click</text></a></svg>'
    }
  }
})
console.log(i18n.global.t('xlink'))
console.log(i18n.global.t('animation'))
// v11.4.16: both are returned unchanged

Rendered with v-html, a click on either link runs alert(1) in the origin of the page. We checked this in Chromium 143, Chrome 156 and WebKit 26, and one of the reporters also confirmed the xlink:href case in Firefox.

Impact

Applications are affected when they enable escapeParameter, render translations as HTML (for example with v-html), and one of the following applies:

• message content is not fully trusted (for example crowdsourced or stored translations), or
• an untrusted value is passed as a parameter that the message places inside xlink:href. An attacker can then run script in the origin of the application when the user clicks the link (DOM-based XSS), despite the sanitizer. Rendering through <i18n-t> is not affected, since it does not render translations as HTML.

Patches

Fixed in 11.4.17 and 12.0.0-alpha.8. The sanitizer now checks javascript: URLs in xlink:href in the same way as in href, and turns the start tags of <animate> and <set> into text. It does the same for <base>, which changes how the page resolves relative URLs. SVG animations with <animate> or <set> in translations no longer run while escapeParameter is enabled. v9 and v10 are no longer supported and will not be fixed. Please migrate to v11.

Workarounds

• Do not render translations that can contain untrusted content with v-html. Use component interpolation (<i18n-t>) instead.
• Do not put SVG links or SVG animations in translation messages, and do not pass values into xlink:href.

References

• CWE-79, CWE-116, CWE-184
• GHSA-x8qp-wqqm-57ph (CVE-2025-53892): the fix that added sanitizeTranslatedHtml()
• GHSA-83rm-6c8r-g728 (CVE-2026-118257): an earlier bypass of the sanitizer through srcdoc
• SVG 2: Linking