escapeParameter: The sanitizer now also turns <script> in translations into text. A <script> does not run with v-html in the browser, but it runs when the translation is rendered on the server (SSR). (a66ace0a) See GHSA-jrxq-gc2q-9357.
What's Changed
🔒 Security Fixes
- fix(shared): neutralize script elements in sanitizeTranslatedHtml (a66ace0a)
Full Changelog: v12.0.0-alpha.8...v12.0.0-alpha.9