Skip to content
Heist/ feed
Back to feed
Medium

Cross-site Scripting vulnerability with prototype pollution in vue-i18n

Type: advisorySources: OSV

vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibility of Cross-site Scripting attack. This issue has been addressed in versions 9.14.2, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2024-52809
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 21:10 UTC · Revision 1

Source evidence

Cross-site Scripting vulnerability with prototype pollution in vue-i18n

core-osv · Original source

Published 29 Nov 2024, 18:32 UTC

vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibility of Cross-site Scripting attack. This issue has been addressed in versions 9.14.2, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

osv:CVE-2024-52809
Complete source record
{
  "id": "cff14dc0938a2fe39bd1ab9356770899ff1a32c84911a84285d5233039027a18",
  "url": "https://osv.dev/vulnerability/CVE-2024-52809",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Cross-site Scripting vulnerability with prototype pollution in vue-i18n",
    "summary": "vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibility of Cross-site Scripting attack. This issue has been addressed in versions 9.14.2, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
    "evidence": "osv:CVE-2024-52809",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2024-52809",
      "aliases": [
        "CVE-2024-52809",
        "GHSA-9r9m-ffp6-9x4v"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/intlify/vue-i18n",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "5448139375d123c90019f372404de6138ff6b588"
                },
                {
                  "introduced": "a0115961d4f9397e246c95cf9cb958beebff5da2"
                },
                {
                  "fixed": "be77fccb0fe2b1834f3b6431fd5036b23470ae9d"
                },
                {
                  "fixed": "72f0d323006fc7363b18cab62d4522dadd874411"
                },
                {
                  "fixed": "9f20909ef8c9232a1072d7818e12ed6d6451024d"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "9.14.2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "10.0.0"
                      },
                      {
                        "fixed": "10.0.5"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "72f0d323006fc7363b18cab62d4522dadd874411"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "9f20909ef8c9232a1072d7818e12ed6d6451024d"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v10.0.4",
            "v9.14.1",
            "v10.0.3",
            "v10.0.2",
            "v10.0.1",
            "v10.0.0",
            "v9.14.0",
            "v9.13.1",
            "v9.13.0",
            "v9.12.1",
            "v9.12.0",
            "v9.11.1",
            "v9.11.0",
            "v9.10.2",
            "v9.10.1",
            "v9.10.0",
            "v9.9.1",
            "v9.9.0",
            "v9.8.0",
            "v9.7.1",
            "v9.7.0",
            "v9.6.5",
            "v9.6.4",
            "v9.6.3",
            "v9.6.2",
            "v9.6.1",
            "v9.6.0",
            "v9.5.0",
            "v9.4.1",
            "v9.4.0",
            "v9.3.0",
            "v9.3.0-beta.27",
            "v9.3.0-beta.26",
            "v9.3.0-beta.25",
            "v9.3.0-beta.24",
            "v9.3.0-beta.23",
            "v9.3.0-beta.22",
            "v9.3.0-beta.21",
            "v9.3.0-beta.20",
            "v9.3.0-beta.19",
            "v9.3.0-beta.18",
            "v9.3.0-beta.17",
            "v9.3.0-beta.16",
            "v9.3.0-beta.15",
            "v9.3.0-beta.14",
            "v9.3.0-beta.13",
            "v9.3.0-beta.12",
            "v9.3.0-beta.11",
            "v9.3.0-beta.10",
            "v9.3.0-beta.9",
            "v9.3.0-beta.8",
            "v9.3.0-beta.7",
            "v9.3.0-beta.6",
            "v9.3.0-beta.5",
            "v9.3.0-beta.4",
            "v9.3.0-beta.3",
            "v9.3.0-beta.2",
            "v9.3.0-beta.1",
            "v9.3.0-beta.0",
            "v9.2.2",
            "v9.2.1",
            "v9.2.0",
            "v9.2.0-beta.40",
            "v9.2.0-beta.39",
            "v9.2.0-beta.38",
            "v9.2.0-beta.37",
            "v9.2.0-beta.36",
            "v9.2.0-beta.35",
            "v9.2.0-beta.34",
            "v9.2.0-beta.33",
            "v9.2.0-beta.32",
            "v9.2.0-beta.31",
            "v9.2.0-beta.30",
            "v9.2.0-beta.29",
            "v9.2.0-beta.28",
            "v9.2.0-beta.27",
            "v9.2.0-beta.26",
            "v9.2.0-beta.25",
            "v9.2.0-beta.24",
            "v9.2.0-beta.23",
            "v9.2.0-beta.22",
            "v9.2.0-beta.21",
            "v9.2.0-beta.20",
            "v9.2.0-beta.19",
            "v9.2.0-beta.18",
            "v9.2.0-beta.17",
            "v9.2.0-beta.16",
            "v9.2.0-beta.15",
            "v9.2.0-beta.14",
            "v9.2.0-beta.13",
            "v9.2.0-beta.12",
            "v9.2.0-beta.11",
            "v9.2.0-beta.10",
            "v9.2.0-beta.9",
            "v9.2.0-beta.8",
            "v9.2.0-beta.7",
            "v9.2.0-beta.6",
            "v9.2.0-beta.5",
            "v9.2.0-beta.4",
            "v9.2.0-beta.3",
            "v9.2.0-beta.2",
            "v9.2.0-beta.1",
            "v9.2.0-alpha.9",
            "v9.2.0-alpha.8",
            "v9.2.0-alpha.7",
            "v9.2.0-alpha.6",
            "v9.2.0-alpha.5",
            "v9.1.6",
            "v9.2.0-alpha.4",
            "v9.2.0-alpha.3",
            "v9.2.0-alpha.2",
            "v9.2.0-alpha.1",
            "v9.1.5",
            "v9.1.4",
            "v9.1.3",
            "v9.1.2",
            "v9.1.1",
            "v9.1.0",
            "v9.0.0",
            "v9.0.0-rc.9",
            "v9.0.0-rc.8",
            "v9.0.0-rc.7",
            "v9.0.0-rc.6",
            "v9.0.0-rc.5",
            "v9.0.0-rc.4",
            "v9.0.0-rc.3",
            "v9.0.0-rc.2",
            "v9.0.0-rc.1",
            "v9.0.0-beta.18",
            "v9.0.0-beta.17",
            "v9.0.0-beta.16",
            "v9.0.0-beta.15",
            "v9.0.0-beta.14",
            "v9.0.0-beta.13",
            "v9.0.0-beta.12",
            "v9.0.0-beta.11",
            "v9.0.0-beta.10",
            "v9.0.0-beta.9",
            "v9.0.0-beta.8",
            "v9.0.0-beta.7",
            "v9.0.0-beta.6",
            "v9.0.0-beta.5",
            "v9.0.0-beta.4",
            "v9.0.0-beta.3",
            "v9.0.0-beta.2",
            "v9.0.0-beta.1",
            "v9.0.0-alpha.17",
            "v9.0.0-alpha.16",
            "v9.0.0-alpha.15",
            "v9.0.0-alpha.14",
            "v9.0.0-alpha.13",
            "v9.0.0-alpha.12",
            "v9.0.0-alpha.11",
            "v9.0.0-alpha.10",
            "v9.0.0-alpha.9",
            "v9.0.0-alpha.8",
            "v9.0.0-alpha.7",
            "v9.0.0-alpha.6",
            "v9.0.0-alpha.5",
            "v9.0.0-alpha.4",
            "v9.0.0-alpha.3",
            "v9.0.0-alpha.2",
            "v9.0.0-alpha.1",
            "v9.0.0-alpha.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-52809.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:39.462055120Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52809.json",
        "https://github.com/intlify/vue-i18n/security/advisories/GHSA-9r9m-ffp6-9x4v",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-52809",
        "https://github.com/intlify/vue-i18n/commit/72f0d323006fc7363b18cab62d4522dadd874411",
        "https://github.com/intlify/vue-i18n/commit/9f20909ef8c9232a1072d7818e12ed6d6451024d"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-79"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52809.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-52809",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 507070,
  "published_at": "2024-11-29T18:32:36.527+00:00"
}