Vue i18n v11.4.18
intlify/vue-i18n
Summary
The v11.4.18 release of Vue i18n introduces a crucial security fix that sanitizes `<script>` elements in translations, preventing them from executing during server-side rendering (SSR). This update enhances the safety of using translations with `v-html` by neutralizing potentially harmful script tags.
Full release notes
escapeParameter: The sanitizer now also turns <script> in translations into text. A <script> does not run with v-html in the browser, but it runs when the translation is rendered on the server (SSR). (#2757) See GHSA-jrxq-gc2q-9357.
What's Changed
🔒 Security Fixes
- fix(shared): neutralize script elements in sanitizeTranslatedHtml by @kazupon in https://github.com/intlify/vue-i18n/pull/2757
Full Changelog: https://github.com/intlify/vue-i18n/compare/v11.4.17...v11.4.18
