Summary
Vue I18n's translation sanitization can leave an iframe srcdoc attribute active after escaping markup and event-handler text. When applications enable escapeParameter and render translations as HTML with v-html, attacker-controlled parameters or translation content may execute script in a same-origin nested document.
Vue I18n's translation sanitization can leave an iframe srcdoc attribute active after escaping markup and event-handler text. When applications enable escapeParameter and render translations as HTML with v-html, attacker-controlled parameters or translation content may execute script in a same-origin nested document.
Affected context
The issue affects Vue I18n applications using vulnerable releases where all of the following conditions may apply:
- Translations or interpolated parameters are rendered as HTML through
v-html escapeParameteris enabled- Sanitized content can reach an iframe
srcdocattribute - Attacker-controlled input or untrusted translation content can influence that value
The related i18n-t rendering path is not affected according to the vulnerability description.
The issue affects Vue I18n applications using vulnerable releases where all of the following conditions may apply:
- Translations or interpolated parameters are rendered as HTML through
v-html escapeParameteris enabled- Sanitized content can reach an iframe
srcdocattribute - Attacker-controlled input or untrusted translation content can influence that value
The related i18n-t rendering path is not affected according to the vulnerability description.
Exploit preconditions
- Attack surface: Client-side translation rendering and iframe
srcdochandling - Required access: Ability to influence translation content or parameters used in rendered HTML
- Trigger point: Browser parsing of a generated iframe
srcdocvalue - Why exploitation is possible: Character references are decoded before the nested document is parsed, while the active
srcdoccontext remains available for script execution
- Attack surface: Client-side translation rendering and iframe
srcdochandling - Required access: Ability to influence translation content or parameters used in rendered HTML
- Trigger point: Browser parsing of a generated iframe
srcdocvalue - Why exploitation is possible: Character references are decoded before the nested document is parsed, while the active
srcdoccontext remains available for script execution
Why this happens
The sanitizer escapes markup and event-handler text but does not neutralize the srcdoc attribute as an executable HTML document context. Browsers subsequently decode character references and parse the attribute value as same-origin nested HTML, allowing attacker-controlled content to become script-capable markup. This maps primarily to CWE-79: Improper Neutralization of Input During Web Page Generation, with CWE-116: Improper Encoding or Escaping of Output describing the incomplete context-sensitive escaping.
The sanitizer escapes markup and event-handler text but does not neutralize the srcdoc attribute as an executable HTML document context. Browsers subsequently decode character references and parse the attribute value as same-origin nested HTML, allowing attacker-controlled content to become script-capable markup. This maps primarily to CWE-79: Improper Neutralization of Input During Web Page Generation, with CWE-116: Improper Encoding or Escaping of Output describing the incomplete context-sensitive escaping.
Potential impact
- Script execution in the security origin of the affected application
- Theft of accessible session data or application information
- Unauthorized actions performed through the victim's browser
- Manipulation of displayed translations or application content
- Abuse of trusted application context for phishing or further attacks
- Script execution in the security origin of the affected application
- Theft of accessible session data or application information
- Unauthorized actions performed through the victim's browser
- Manipulation of displayed translations or application content
- Abuse of trusted application context for phishing or further attacks
General mitigation guidance
Mitigation generally focuses on preventing untrusted content from reaching executable HTML contexts and applying context-aware output handling.
Common defensive patterns include:
- Prefer text-oriented translation rendering instead of HTML rendering where possible
- Avoid placing untrusted values in iframe
srcdocor other document-embedding contexts - Use a well-maintained, context-aware HTML sanitizer that handles active attributes and nested document contexts
- Keep translation sources and interpolated parameters within explicit trust boundaries
- Apply restrictive Content Security Policy controls as defense in depth
- Enforce least privilege for browser-facing application capabilities and limit sensitive data exposed to the page
Mitigation generally focuses on preventing untrusted content from reaching executable HTML contexts and applying context-aware output handling.
Common defensive patterns include:
- Prefer text-oriented translation rendering instead of HTML rendering where possible
- Avoid placing untrusted values in iframe
srcdocor other document-embedding contexts - Use a well-maintained, context-aware HTML sanitizer that handles active attributes and nested document contexts
- Keep translation sources and interpolated parameters within explicit trust boundaries
- Apply restrictive Content Security Policy controls as defense in depth
- Enforce least privilege for browser-facing application capabilities and limit sensitive data exposed to the page
How teams detect issues like this
Organizations can look for this issue through:
- Static analysis rules identifying translation output passed to
v-html - Code review checks for user-controlled values entering
srcdoc, iframe attributes, or HTML-generating APIs - Tests that exercise character references, nested document contexts, and event-handler-related input
- Dependency and policy checks for vulnerable Vue I18n release ranges
- Runtime monitoring for unexpected iframe creation, DOM mutation, or script execution associated with translated content
Automated application-security and dependency-review tools may help identify unsafe rendering patterns, but context-specific testing remains important.
Organizations can look for this issue through:
- Static analysis rules identifying translation output passed to
v-html - Code review checks for user-controlled values entering
srcdoc, iframe attributes, or HTML-generating APIs - Tests that exercise character references, nested document contexts, and event-handler-related input
- Dependency and policy checks for vulnerable Vue I18n release ranges
- Runtime monitoring for unexpected iframe creation, DOM mutation, or script execution associated with translated content
Automated application-security and dependency-review tools may help identify unsafe rendering patterns, but context-specific testing remains important.
