Vulnerability · Published Nov 29, 2024 · Assigned by GitHub_M
CVE-2024-52809Cross-site Scripting vulnerability with prototype pollution in vue-i18n
Medium 5.3
In plain English
A medium-severity cross-site scripting in vue-i18n from intlify. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibility of Cross-site Scripting attack. This issue has been addressed in versions 9.14.2, and 10.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @intlify/core | 10.0.5 | GHSA-9r9m-ffp6-9x4v |
| npm | @intlify/core | 9.14.2 | GHSA-9r9m-ffp6-9x4v |
| npm | @intlify/core-base | 10.0.5 | GHSA-9r9m-ffp6-9x4v |
| npm | @intlify/core-base | 9.14.2 | GHSA-9r9m-ffp6-9x4v |
| npm | @intlify/vue-i18n-core | 10.0.5 | GHSA-9r9m-ffp6-9x4v |
| npm | @intlify/vue-i18n-core | 9.14.2 | GHSA-9r9m-ffp6-9x4v |
| npm | petite-vue-i18n | 10.0.5 | GHSA-9r9m-ffp6-9x4v |
| npm | vue-i18n | 10.0.5 | GHSA-9r9m-ffp6-9x4v |
| npm | vue-i18n | 9.14.2 | GHSA-9r9m-ffp6-9x4v |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N