CVE-2024-52809: @intlify/core base Cross-Site Scripting Vulnerability

Q: What is CVE-2024-52809?

CVE-2024-52809 is a security vulnerability in @intlify/core base involving vue-i18n has cross-site scripting vulnerability with prototype pollution under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

Q: Which @intlify/core base versions are affected?

Affected versions include releases prior to 9.14.2, 10.0.5 across affected packages: @intlify/core-base, vue-i18n, @intlify/core, @intlify/vue-i18n-core, petite-vue-i18n.

Q: What version fixes CVE-2024-52809?

Upgrading to 9.14.2, 10.0.5 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is @intlify/core-base affected?

Yes, @intlify/core-base is affected in releases prior to 9.14.2, 10.0.5. Upgrade your dependency to 9.14.2, 10.0.5 or later.

Q: Is vue-i18n affected?

Yes, vue-i18n is affected in releases prior to 9.14.2, 10.0.5. Upgrade your dependency to 9.14.2, 10.0.5 or later.

Q: What CWE is associated with CVE-2024-52809?

CVE-2024-52809 is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.).

Q: How can I check npm dependencies for CVE-2024-52809?

Run the dependency tree command: 'npm ls @intlify/core-base'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

MODERATE

Advisory Identifier: GHSA-9r9m-ffp6-9x4v

CWE-79

Published 2024-12-02

Advisory Summary

CVE-2024-52809 is a MODERATE cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting @intlify/core base libraries in the npm ecosystem. The issue involves vue-i18n has cross-site scripting vulnerability with prototype pollution. Remediation is available by upgrading affected packages to version 9.14.2, 10.0.5.

CVE-2024-52809 at a Glance

CVE Identifier CVE-2024-52809

GHSA Identifier GHSA-9r9m-ffp6-9x4v

Severity MODERATE

CVSS v3.1 Base Score N/A

CWE Classification CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Product @intlify/core base

Package Ecosystem npm

Published Date 2024-12-02

Last Updated 2024-12-02

How to Fix CVE-2024-52809

To remediate this vulnerability, upgrade all affected @intlify/core base dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

@intlify/core-base fixed: 9.14.2

npm install @intlify/core-base@9.14.2

vue-i18n fixed: 9.14.2

npm install vue-i18n@9.14.2

@intlify/core fixed: 9.14.2

npm install @intlify/core@9.14.2

@intlify/vue-i18n-core fixed: 9.14.2

npm install @intlify/vue-i18n-core@9.14.2

petite-vue-i18n fixed: 10.0.5

npm install petite-vue-i18n@10.0.5

@intlify/core-base fixed: 10.0.5

npm install @intlify/core-base@10.0.5

vue-i18n fixed: 10.0.5

npm install vue-i18n@10.0.5

@intlify/core fixed: 10.0.5

npm install @intlify/core@10.0.5

@intlify/vue-i18n-core fixed: 10.0.5

npm install @intlify/vue-i18n-core@10.0.5

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

npm ls @intlify/core-base

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2024-52809, inspect your project dependencies using npm:

npm ls @intlify/core-base

Analyze the terminal output to locate any version of @intlify/core base in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 9.14.2), your application is affected.

Note: The npm ls @intlify/core-base command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In @intlify/core base, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Vulnerability type XSS ### Description vue-i18n can be passed locale messages to `createI18n` or `useI18n`. we can then translate them using `t` and `$t`. vue-i18n has its own syntax for local messages, and uses a message compiler to generate AST. In order to maximize the performance of the translation function, vue-i18n uses bundler plugins such as `@intlify/unplugin-vue-i18n` and bulder to convert the AST in advance when building the application. By using that AST as the locale message, it is no longer necessary to compile, and it is possible to translate using the AST. The AST generated by the message compiler has special properties for each node in the AST tree to maximize performance. In the PoC example below, it is a `static` property, but that is just one of the optimizations. About details of special properties, see https://github.com/intlify/vue-i18n/blob/master/packages/message-compiler/src/nodes.ts In general, the locale messages of vue-i18n are optimized during production builds using `@intlify/unplugin-vue-i18n`, so there is always a property that is attached during optimization like this time. But if you are using a locale message AST in development mode or your own, there is a possibility of XSS if a third party injects. ### Reproduce (PoC) ```html <!doctype html> <html> <head> <meta charset="utf-8" /> <title>vue-i18n XSS</title> <script src="https://unpkg.com/vue@3"></script> <script src="https://unpkg.com/vue-i18n@10"></script>  <script> /** * Prototype pollution vulnerability with `Object.prototype`. * The 'static' property is part of the optimized AST generated by the vue-i18n message compiler. * About details of special properties, see https://github.com/intlify/vue-i18n/blob/master/packages/message-compiler/src/nodes.ts * * In general, the locale messages of vue-i18n are optimized during production builds using `@intlify/unplugin-vue-i18n`, * so there is always a property that is attached during optimization like this time. * But if you are using a locale message AST in development or your own, there is a possibility of XSS if a third party injects prototype pollution code. */ Object.defineProperty(Object.prototype, 'static', { configurable: true, get() { alert('prototype polluted!') return 'prototype pollution' } }) </script> </head> <body> <div id="app"> <p>{{ t('hello') }}</p> </div> <script> const { createApp } = Vue const { createI18n, useI18n } = VueI18n // AST style locale message, which build by `@intlify/unplugin-vue-i18n` const en = { hello: { type: 0, body: { items: [ { type: 3, value: 'hello world!' } ] } } } const i18n = createI18n({ legacy: false, locale: 'en', messages: { en } }) const app = createApp({ setup() { const { t } = useI18n() return { t } } }) app.use(i18n) app.mount('#app') </script> </body> </html> ``` ### Workarounds Before v10.0.0, we can work around this vulnerability by using the regular compilation (`jit: false` of `@intlify/unplugin-vue-i18n` plugin configuration) way instead of jit compilation. - jit compilation: https://vue-i18n.intlify.dev/guide/advanced/optimization.html#jit-compilation - bundler plugin option: https://github.com/intlify/bundle-tools/tree/main/packages/unplugin-vue-i18n#jitcompilation ### References - [Simillar case: Vue 2 XSS vulnerability with prototype pollution](https://www.herodevs.com/vulnerability-directory/cve-2024-6783)

CVE-2024-52809 Affected @intlify/core base Versions

9 component(s)

Fixed Versions:

9.14.210.0.5

Product / Package	Ecosystem	Affected Versions	Fixed Version
@intlify/core-base npm/@intlify/core-base	npm	≥ 9.3.0 < 9.14.2	9.14.2
vue-i18n npm/vue-i18n	npm	≥ 9.3.0 < 9.14.2	9.14.2
@intlify/core npm/@intlify/core	npm	≥ 9.3.0 < 9.14.2	9.14.2
@intlify/vue-i18n-core npm/@intlify/vue-i18n-core	npm	≥ 9.3.0 < 9.14.2	9.14.2
petite-vue-i18n npm/petite-vue-i18n	npm	≥ 10.0.0 < 10.0.5	10.0.5
@intlify/core-base npm/@intlify/core-base	npm	≥ 10.0.0 < 10.0.5	10.0.5
vue-i18n npm/vue-i18n	npm	≥ 10.0.0 < 10.0.5	10.0.5
@intlify/core npm/@intlify/core	npm	≥ 10.0.0 < 10.0.5	10.0.5
@intlify/vue-i18n-core npm/@intlify/vue-i18n-core	npm	≥ 10.0.0 < 10.0.5	10.0.5

References

GitHub Advisory / Wiki ADVISORY

https://github.com/intlify/vue-i18n/security/advisories/GHSA-9r9m-ffp6-9x4v

NVD — CVE-2024-52809 NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-52809

Security Fix Commit FIX COMMIT

https://github.com/intlify/vue-i18n/commit/72f0d323006fc7363b18cab62d4522dadd874411

Security Fix Commit FIX COMMIT

https://github.com/intlify/vue-i18n/commit/9f20909ef8c9232a1072d7818e12ed6d6451024d

@intlify/core base Source Repository REPOSITORY

https://github.com/intlify/vue-i18n

Frequently Asked Questions

What is CVE-2024-52809?

CVE-2024-52809 is a security vulnerability in @intlify/core base involving vue-i18n has cross-site scripting vulnerability with prototype pollution under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

Which @intlify/core base versions are affected?

Affected versions include releases prior to 9.14.2, 10.0.5 across affected packages: @intlify/core-base, vue-i18n, @intlify/core, @intlify/vue-i18n-core, petite-vue-i18n.

What version fixes CVE-2024-52809?

Upgrading to 9.14.2, 10.0.5 (or the latest patched release for your respective branch) resolves the vulnerability.

Is @intlify/core-base affected?

Yes, @intlify/core-base is affected in releases prior to 9.14.2, 10.0.5. Upgrade your dependency to 9.14.2, 10.0.5 or later.

Is vue-i18n affected?

Yes, vue-i18n is affected in releases prior to 9.14.2, 10.0.5. Upgrade your dependency to 9.14.2, 10.0.5 or later.

What CWE is associated with CVE-2024-52809?

CVE-2024-52809 is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.).

How can I check npm dependencies for CVE-2024-52809?

Run the dependency tree command: 'npm ls @intlify/core-base'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-9r9m-ffp6-9x4v",
  "modified" : "2024-12-02T17:26:21Z",
  "published" : "2024-12-02T17:26:20Z",
  "aliases" : [ "CVE-2024-52809" ],
  "summary" : "vue-i18n has cross-site scripting vulnerability with prototype pollution",
  "details" : "### Vulnerability type\nXSS\n\n### Description\nvue-i18n can be passed locale messages to `createI18n` or `useI18n`.\nwe can then translate them using `t` and `$t`.\nvue-i18n has its own syntax for local messages, and uses a message compiler to generate AST.\nIn order to maximize the performance of the translation function, vue-i18n uses bundler plugins such as `@intlify/unplugin-vue-i18n` and bulder to convert the AST in advance when building the application.\nBy using that AST as the locale message, it is no longer necessary to compile, and it is possible to translate using the AST.\n\nThe AST generated by the message compiler has special properties for each node in the AST tree to maximize performance. In the PoC example below, it is a `static` property, but that is just one of the optimizations.\nAbout details of special properties, see https://github.com/intlify/vue-i18n/blob/master/packages/message-compiler/src/nodes.ts\n\nIn general, the locale messages of vue-i18n are optimized during production builds using `@intlify/unplugin-vue-i18n`,\nso there is always a property that is attached during optimization like this time.\nBut if you are using a locale message AST in development mode or your own, there is a possibility of XSS if a third party injects.\n\n### Reproduce (PoC)\n```html\n<!doctype html>\n<html>\n  <head>\n    <meta charset=\"utf-8\" />\n    <title>vue-i18n XSS</title>\n    <script src=\"https://unpkg.com/vue@3\"></script>\n    <script src=\"https://unpkg.com/vue-i18n@10\"></script>\n    <!-- Scripts that perform prototype contamination, such as being distributed from malicious hosting sites or injected through supply chain attacks, etc. -->\n    <script>\n      /**\n       * Prototype pollution vulnerability with `Object.prototype`.\n       * The 'static' property is part of the optimized AST generated by the vue-i18n message compiler.\n       * About details of special properties, see https://github.com/intlify/vue-i18n/blob/master/packages/message-compiler/src/nodes.ts\n       *\n       * In general, the locale messages of vue-i18n are optimized during production builds using `@intlify/unplugin-vue-i18n`,\n       * so there is always a property that is attached during optimization like this time.\n       * But if you are using a locale message AST in development or your own, there is a possibility of XSS if a third party injects prototype pollution code.\n       */\n      Object.defineProperty(Object.prototype, 'static', {\n        configurable: true,\n        get() {\n          alert('prototype polluted!')\n          return 'prototype pollution'\n        }\n      })\n    </script> \n </head>\n  <body>\n    <div id=\"app\">\n      <p>{{ t('hello') }}</p>\n    </div>\n    <script>\n      const { createApp } = Vue\n      const { createI18n, useI18n } = VueI18n\n\n      // AST style locale message, which build by `@intlify/unplugin-vue-i18n`\n      const en = {\n        hello: {\n          type: 0,\n          body: {\n            items: [\n              {\n                type: 3,\n                value: 'hello world!'\n              }\n            ]\n          }\n        }\n      }\n\n      const i18n = createI18n({\n        legacy: false,\n        locale: 'en',\n        messages: {\n          en\n        }\n      })\n\n      const app = createApp({\n        setup() {\n          const { t } = useI18n()\n          return { t }\n        }\n      })\n      app.use(i18n)\n      app.mount('#app')\n    </script>\n  </body>\n</html>\n```\n\n### Workarounds\nBefore v10.0.0, we can work around this vulnerability by using the regular compilation (`jit: false` of `@intlify/unplugin-vue-i18n` plugin configuration) way instead of jit compilation.\n- jit compilation: https://vue-i18n.intlify.dev/guide/advanced/optimization.html#jit-compilation\n- bundler plugin option: https://github.com/intlify/bundle-tools/tree/main/packages/unplugin-vue-i18n#jitcompilation\n\n### References\n- [Simillar case: Vue 2 XSS vulnerability with prototype pollution](https://www.herodevs.com/vulnerability-directory/cve-2024-6783)\n",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@intlify/core-base"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "9.3.0"
      }, {
        "fixed" : "9.14.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "vue-i18n"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "9.3.0"
      }, {
        "fixed" : "9.14.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@intlify/core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "9.3.0"
      }, {
        "fixed" : "9.14.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@intlify/vue-i18n-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "9.3.0"
      }, {
        "fixed" : "9.14.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "petite-vue-i18n"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "10.0.0"
      }, {
        "fixed" : "10.0.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@intlify/core-base"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "10.0.0"
      }, {
        "fixed" : "10.0.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "vue-i18n"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "10.0.0"
      }, {
        "fixed" : "10.0.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@intlify/core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "10.0.0"
      }, {
        "fixed" : "10.0.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@intlify/vue-i18n-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "10.0.0"
      }, {
        "fixed" : "10.0.5"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/intlify/vue-i18n/security/advisories/GHSA-9r9m-ffp6-9x4v"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-52809"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/intlify/vue-i18n/commit/72f0d323006fc7363b18cab62d4522dadd874411"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/intlify/vue-i18n/commit/9f20909ef8c9232a1072d7818e12ed6d6451024d"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/intlify/vue-i18n"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-12-02T17:26:20Z",
    "nvd_published_at" : "2024-11-29T19:15:09Z"
  }
}

CVSS V4

N/A MODERATE

Attack Vector N/A

Attack Complexity N/A

Privileges Required N/A

User Interaction N/A

Scope N/A

Confidentiality N/A

Integrity N/A

Availability N/A

Vector String

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Advisory Metadata

Source ID: GHSA-9r9m-ffp6-9x4v
Schema Version: 1.4.0
Published: 2024-12-02 17:26
Last Modified: 2024-12-02 17:26
Database Record File: advisories/github-reviewed/2024/12/GHSA-9r9m-ffp6-9x4v/GHSA-9r9m-ffp6-9x4v.json