Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

Summary

When escapeParameter is enabled (escapeParameterHtml in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. escapeParams() escapes either the list values or the named values, but not both: the two branches are joined by else. When a single call passes both, for example t(key, ['...'], { named: { ... } }), the named values reach the message without being escaped.

Details

escapeParams() in packages/core-base/src/translate.ts (v11.4.13):

function escapeParams(options: TranslateOptions) {
  if (isArray(options.list)) {
    options.list = options.list.map(item => (isString(item) ? escapeHtml(item) : item))
  } else if (isObject(options.named)) {
    // ...escapes the named values
  }
}

t(key, list, options) is a public overload, and TranslateOptions has a named field, so a call can carry both. The list is checked first, and the named values are then left as they are.

The translated string still goes through sanitizeTranslatedHtml() (added for CVE-2025-53892), which neutralizes event handler attributes and javascript: URLs. Other markup in the named values, such as links and forms, is inserted as is. Before the fix for GHSA-83rm-6c8r-g728, an <iframe srcdoc> in a named value also passes the sanitizer, and script runs. Versions without the sanitizer (before 9.14.5, 10.0.8 and 11.1.10, and 12.0.0-alpha.1 to alpha.3) insert the named values as HTML without any further check.

<i18n-t> is not affected: it passes either list or named values, never both, and it does not render translations as HTML.

PoC

import { createI18n } from 'vue-i18n'

const i18n = createI18n({
  legacy: false,
  locale: 'en',
  escapeParameter: true,
  messages: {
    en: { withList: '{0} {name}', withoutList: '{name}' }
  }
})
const t = i18n.global.t

t('withoutList', { name: '<b>x</b>' })
// &lt;b&gt;x&lt;&#x2F;b&gt;      escaped

t('withList', ['a'], { named: { name: '<b>x</b>' } })
// a <b>x</b>                   not escaped (v11.4.13)

Impact

Applications are affected when they enable escapeParameter, render translations as HTML (for example with v-html), and pass untrusted named values in the same call as a list. The named values are inserted as markup: phishing links, forms, or layout changes. Together with GHSA-83rm-6c8r-g728, or on versions without the sanitizer, this leads to script execution (DOM-based XSS).