{"items":[{"id":"NVI-00013780","kind":"vulnerability","title":"Vue I18n Allows Prototype Pollution in `handleFlatJson`","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-p2ph-7g93-hw3m","CVE-2025-27597"],"plain_summary":"GitHub lists this reviewed advisory for @intlify/message-resolver, @intlify/vue-i18n-core, petite-vue-i18n, vue-i18n, @intlify/core-base. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-01c3c1a8f210d5de93f4c8f9e83c6fdf"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-01c3c1a8f210d5de93f4c8f9e83c6fdf","url":"https://github.com/advisories/GHSA-p2ph-7g93-hw3m","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-p2ph-7g93-hw3m","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T09:56:37.775Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-01c3c1a8f210d5de93f4c8f9e83c6fdf"],"technology":"@intlify/message-resolver","known_exclusions":[],"conditions_summary":"**Vulnerability type:**\nPrototype Pollution\n\n**Vulnerability Location(s):**\n```js\n# v9.1\nnode_modules/@intlify/message-resolver/index.js\n\n# v9.2 or later\nnode_modules/@intlify/vue-i18n-core/index.js\n```\n\n**Description:**\n\nThe latest version of `@intlify/message-resolver (9.1)` and `@intlify/vue-i18n-core (9.2 or later)`, (previous versions might also affected), is vulnerable to Prototype Pollution through the entry function(s) `handleFlatJson`. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.\n\n\n**PoC:**\n\n```bash\n// install the package with the latest version\n~$ npm install @intlify/message-resolver@9.1.10\n// run the script mentioned below \n~$ node poc.js\n//The expected output (if the code still vulner","public_affected_ranges":[">= 9.1.0, < 9.1.11"]},{"certainty":"source_listed","source_ids":["sr-01c3c1a8f210d5de93f4c8f9e83c6fdf"],"technology":"@intlify/vue-i18n-core","known_exclusions":[],"conditions_summary":"**Vulnerability type:**\nPrototype Pollution\n\n**Vulnerability Location(s):**\n```js\n# v9.1\nnode_modules/@intlify/message-resolver/index.js\n\n# v9.2 or later\nnode_modules/@intlify/vue-i18n-core/index.js\n```\n\n**Description:**\n\nThe latest version of `@intlify/message-resolver (9.1)` and `@intlify/vue-i18n-core (9.2 or later)`, (previous versions might also affected), is vulnerable to Prototype Pollution through the entry function(s) `handleFlatJson`. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.\n\n\n**PoC:**\n\n```bash\n// install the package with the latest version\n~$ npm install @intlify/message-resolver@9.1.10\n// run the script mentioned below \n~$ node poc.js\n//The expected output (if the code still vulner","public_affected_ranges":[">= 9.2.0, < 9.14.3"]},{"certainty":"source_listed","source_ids":["sr-01c3c1a8f210d5de93f4c8f9e83c6fdf"],"technology":"petite-vue-i18n","known_exclusions":[],"conditions_summary":"**Vulnerability type:**\nPrototype Pollution\n\n**Vulnerability Location(s):**\n```js\n# v9.1\nnode_modules/@intlify/message-resolver/index.js\n\n# v9.2 or later\nnode_modules/@intlify/vue-i18n-core/index.js\n```\n\n**Description:**\n\nThe latest version of `@intlify/message-resolver (9.1)` and `@intlify/vue-i18n-core (9.2 or later)`, (previous versions might also affected), is vulnerable to Prototype Pollution through the entry function(s) `handleFlatJson`. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.\n\n\n**PoC:**\n\n```bash\n// install the package with the latest version\n~$ npm install @intlify/message-resolver@9.1.10\n// run the script mentioned below \n~$ node poc.js\n//The expected output (if the code still vulner","public_affected_ranges":[">= 10.0.0, < 10.0.6"]},{"certainty":"source_listed","source_ids":["sr-01c3c1a8f210d5de93f4c8f9e83c6fdf"],"technology":"vue-i18n","known_exclusions":[],"conditions_summary":"**Vulnerability type:**\nPrototype Pollution\n\n**Vulnerability Location(s):**\n```js\n# v9.1\nnode_modules/@intlify/message-resolver/index.js\n\n# v9.2 or later\nnode_modules/@intlify/vue-i18n-core/index.js\n```\n\n**Description:**\n\nThe latest version of `@intlify/message-resolver (9.1)` and `@intlify/vue-i18n-core (9.2 or later)`, (previous versions might also affected), is vulnerable to Prototype Pollution through the entry function(s) `handleFlatJson`. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.\n\n\n**PoC:**\n\n```bash\n// install the package with the latest version\n~$ npm install @intlify/message-resolver@9.1.10\n// run the script mentioned below \n~$ node poc.js\n//The expected output (if the code still vulner","public_affected_ranges":[">= 9.1.0, < 9.14.3"]},{"certainty":"source_listed","source_ids":["sr-01c3c1a8f210d5de93f4c8f9e83c6fdf"],"technology":"@intlify/core-base","known_exclusions":[],"conditions_summary":"**Vulnerability type:**\nPrototype Pollution\n\n**Vulnerability Location(s):**\n```js\n# v9.1\nnode_modules/@intlify/message-resolver/index.js\n\n# v9.2 or later\nnode_modules/@intlify/vue-i18n-core/index.js\n```\n\n**Description:**\n\nThe latest version of `@intlify/message-resolver (9.1)` and `@intlify/vue-i18n-core (9.2 or later)`, (previous versions might also affected), is vulnerable to Prototype Pollution through the entry function(s) `handleFlatJson`. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.\n\n\n**PoC:**\n\n```bash\n// install the package with the latest version\n~$ npm install @intlify/message-resolver@9.1.10\n// run the script mentioned below \n~$ node poc.js\n//The expected output (if the code still vulner","public_affected_ranges":[">= 9.1.0, < 9.1.11"]},{"certainty":"source_listed","source_ids":["sr-01c3c1a8f210d5de93f4c8f9e83c6fdf"],"technology":"@intlify/core","known_exclusions":[],"conditions_summary":"**Vulnerability type:**\nPrototype Pollution\n\n**Vulnerability Location(s):**\n```js\n# v9.1\nnode_modules/@intlify/message-resolver/index.js\n\n# v9.2 or later\nnode_modules/@intlify/vue-i18n-core/index.js\n```\n\n**Description:**\n\nThe latest version of `@intlify/message-resolver (9.1)` and `@intlify/vue-i18n-core (9.2 or later)`, (previous versions might also affected), is vulnerable to Prototype Pollution through the entry function(s) `handleFlatJson`. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.\n\n\n**PoC:**\n\n```bash\n// install the package with the latest version\n~$ npm install @intlify/message-resolver@9.1.10\n// run the script mentioned below \n~$ node poc.js\n//The expected output (if the code still vulner","public_affected_ranges":[">= 9.1.0, < 9.1.11"]},{"certainty":"source_listed","source_ids":["sr-01c3c1a8f210d5de93f4c8f9e83c6fdf"],"technology":"@intlify/vue-i18n-core","known_exclusions":[],"conditions_summary":"**Vulnerability type:**\nPrototype Pollution\n\n**Vulnerability Location(s):**\n```js\n# v9.1\nnode_modules/@intlify/message-resolver/index.js\n\n# v9.2 or later\nnode_modules/@intlify/vue-i18n-core/index.js\n```\n\n**Description:**\n\nThe latest version of `@intlify/message-resolver (9.1)` and `@intlify/vue-i18n-core (9.2 or later)`, (previous versions might also affected), is vulnerable to Prototype Pollution through the entry function(s) `handleFlatJson`. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.\n\n\n**PoC:**\n\n```bash\n// install the package with the latest version\n~$ npm install @intlify/message-resolver@9.1.10\n// run the script mentioned below \n~$ node poc.js\n//The expected output (if the code still vulner","public_affected_ranges":[">= 10.0.0-alpha.1, < 10.0.6"]},{"certainty":"source_listed","source_ids":["sr-01c3c1a8f210d5de93f4c8f9e83c6fdf"],"technology":"@intlify/vue-i18n-core","known_exclusions":[],"conditions_summary":"**Vulnerability type:**\nPrototype Pollution\n\n**Vulnerability Location(s):**\n```js\n# v9.1\nnode_modules/@intlify/message-resolver/index.js\n\n# v9.2 or later\nnode_modules/@intlify/vue-i18n-core/index.js\n```\n\n**Description:**\n\nThe latest version of `@intlify/message-resolver (9.1)` and `@intlify/vue-i18n-core (9.2 or later)`, (previous versions might also affected), is vulnerable to Prototype Pollution through the entry function(s) `handleFlatJson`. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.\n\n\n**PoC:**\n\n```bash\n// install the package with the latest version\n~$ npm install @intlify/message-resolver@9.1.10\n// run the script mentioned below \n~$ node poc.js\n//The expected output (if the code still vulner","public_affected_ranges":[">= 11.0.0-beta.0, < 11.1.2"]},{"certainty":"source_listed","source_ids":["sr-01c3c1a8f210d5de93f4c8f9e83c6fdf"],"technology":"petite-vue-i18n","known_exclusions":[],"conditions_summary":"**Vulnerability type:**\nPrototype Pollution\n\n**Vulnerability Location(s):**\n```js\n# v9.1\nnode_modules/@intlify/message-resolver/index.js\n\n# v9.2 or later\nnode_modules/@intlify/vue-i18n-core/index.js\n```\n\n**Description:**\n\nThe latest version of `@intlify/message-resolver (9.1)` and `@intlify/vue-i18n-core (9.2 or later)`, (previous versions might also affected), is vulnerable to Prototype Pollution through the entry function(s) `handleFlatJson`. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.\n\n\n**PoC:**\n\n```bash\n// install the package with the latest version\n~$ npm install @intlify/message-resolver@9.1.10\n// run the script mentioned below \n~$ node poc.js\n//The expected output (if the code still vulner","public_affected_ranges":[">= 11.0.0-beta.0, < 11.1.2"]},{"certainty":"source_listed","source_ids":["sr-01c3c1a8f210d5de93f4c8f9e83c6fdf"],"technology":"vue-i18n","known_exclusions":[],"conditions_summary":"**Vulnerability type:**\nPrototype Pollution\n\n**Vulnerability Location(s):**\n```js\n# v9.1\nnode_modules/@intlify/message-resolver/index.js\n\n# v9.2 or later\nnode_modules/@intlify/vue-i18n-core/index.js\n```\n\n**Description:**\n\nThe latest version of `@intlify/message-resolver (9.1)` and `@intlify/vue-i18n-core (9.2 or later)`, (previous versions might also affected), is vulnerable to Prototype Pollution through the entry function(s) `handleFlatJson`. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.\n\n\n**PoC:**\n\n```bash\n// install the package with the latest version\n~$ npm install @intlify/message-resolver@9.1.10\n// run the script mentioned below \n~$ node poc.js\n//The expected output (if the code still vulner","public_affected_ranges":[">= 10.0.0-alpha.1, < 10.0.6"]},{"certainty":"source_listed","source_ids":["sr-01c3c1a8f210d5de93f4c8f9e83c6fdf"],"technology":"vue-i18n","known_exclusions":[],"conditions_summary":"**Vulnerability type:**\nPrototype Pollution\n\n**Vulnerability Location(s):**\n```js\n# v9.1\nnode_modules/@intlify/message-resolver/index.js\n\n# v9.2 or later\nnode_modules/@intlify/vue-i18n-core/index.js\n```\n\n**Description:**\n\nThe latest version of `@intlify/message-resolver (9.1)` and `@intlify/vue-i18n-core (9.2 or later)`, (previous versions might also affected), is vulnerable to Prototype Pollution through the entry function(s) `handleFlatJson`. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.\n\n\n**PoC:**\n\n```bash\n// install the package with the latest version\n~$ npm install @intlify/message-resolver@9.1.10\n// run the script mentioned below \n~$ node poc.js\n//The expected output (if the code still vulner","public_affected_ranges":[">= 11.0.0-beta.0, < 11.1.2"]}],"null_published_at":"2026-11-02T10:00:37.148Z","source_updated_at":"2026-08-25T20:44:03.000Z","source_disclosed_at":"2025-03-07T15:58:24.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T09:56:37.775Z"}],"next_cursor":null,"snapshot_revision":"42594"}