Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
intlify/vue-i18n
master @ 447f8a8
7
Fixes
2
CVEs
HIGH
Peak severity
57.1%
Coverage
Highlights
Prototype Pollution: 4 prior fixes. Scrutinize any change in this area.
packages/core-base/src/translate.ts: most-fixed (2 issues). Treat as high-risk during review.
6 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Prototype Pollution: Recursive or flat JSON path resolution logic (specifically handleFlatJson) can be exploited to inject arbitrary properties onto Object.prototype when properties like '__proto__' are not strictly blocked.
Reflected XSS: Localized translation strings containing user-supplied interpolation arguments can result in HTML injection if not properly sanitized or sanitized incorrectly before entering the DOM post-translation phase.
Prototype Pollution: Deep copying mechanisms that lack strict checks on object structures or prototype paths can allow attackers to override base object prototypes through crafted payload structures.