While working on inkline project, I identified a DOM-based XSS vulnerability in the vue-i18n package (this dependency used by inkline) . This issue is tied to the escapeParameterHtml setting, which fails to fully sanitize certain tag attributes even when enabled, exposing applications to potential script injection attacks.

CVE Link
CVE Report