PT-2025-10096 · Unknown+1 · @Intlify/Message-Resolver+2

Mestrtee · Published 2025-03-07 · Updated 2025-11-20 · CVE-2025-27597

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions @intlify/message-resolver version 9.1 @intlify/vue-i18n-core versions 9.2 and later

Description The vulnerability is a Prototype Pollution issue through the entry function: handleFlatJson. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) as the minimum consequence. The consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.

Recommendations As a temporary workaround, consider disabling the handleFlatJson function until a patch is available. Restrict access to the vulnerable module @intlify/message-resolver and @intlify/vue-i18n-core to minimize the risk of exploitation. Avoid using the proto property in the affected API endpoint until the issue is resolved. Update @intlify/message-resolver and @intlify/vue-i18n-core to a version that contains a fix for this vulnerability.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-27597

GHSA-P2PH-7G93-HW3M

Affected Products

@Intlify/Message-Resolver

@Intlify/Vue-I18N-Core

Node.Js

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27597.json · Exploit
• 🔥 https://github.com/intlify/vue-i18n/security/advisories/GHSA-p2ph-7g93-hw3m · Exploit
• https://osv.dev/vulnerability/CVE-2025-27597 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27597 · Security Note
• https://osv.dev/vulnerability/GHSA-p2ph-7g93-hw3m · Vendor Advisory
• https://github.com/intlify/vue-i18n/commit/4bb6eacda7fc2cde5687549afa0efb27ca40862a · Note
• https://github.com/intlify/vue-i18n · Note
• https://github.com/intlify/vue-i18n/commit/d21e06a7440eed8ada7f522b22fcf830b98d3a53 · Note
• https://github.com/intlify/vue-i18n/releases/tag/v10.0.6 · Note
• https://github.com/intlify/vue-i18n/releases/tag/v9.14.3 · Note
• https://github.com/intlify/vue-i18n/releases/tag/v11.1.2 · Note
• https://github.com/intlify/vue-i18n/commit/fbda9988d3ddd3a1a21740d506d2c183d6b6e36a · Note
• https://github.com/intlify/vue-i18n/commit/feaf13fcff427f2cb1d5ec8076e639506ba28f9e · Note
• https://t.me/cvenotify/113854 · Telegram Post
• https://t.me/cvetracker/18682 · Telegram Post