CVE-2024-52809

Description

vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibility of Cross-site Scripting attack. This issue has been addressed in versions 9.14.2, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Reserved 2024-11-15 | Published 2024-11-29 | Updated 2024-12-02 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

< 9.14.2
affected

>= 10.0.0, < 10.0.5
affected

References

github.com/...e-i18n/security/advisories/GHSA-9r9m-ffp6-9x4v

github.com/...ommit/72f0d323006fc7363b18cab62d4522dadd874411

github.com/...ommit/9f20909ef8c9232a1072d7818e12ed6d6451024d

cve.org (CVE-2024-52809)

nvd.nist.gov (CVE-2024-52809)

Download JSON