GHSA-8rc2-428q-7ww3 - Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

### Summary When `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n escapes the interpolation parameters before formatting a message. `escapeParams()` escapes either the list values or the named values, but not both: the two branches are joined by `else`. When a single call passes both, for example `t(key, ['...'], { named: { ... } })`, the named values reach the message without being escaped. ### Details `escapeParams()` in [`packages/core-base/src/translate.ts` (v11.4.13)](https://github.com/intlify/vue-i18n/blob/v11.4.13/packages/core-base/src/translate.ts): ```ts function escapeParams(options: TranslateOptions) { if (isArray(options.list)) { options.list = options.list.map(item => (isString(item) ? escapeHtml(item) : item)) } else if (isObject(options.named)) { // ...escapes the named values } } ``` `t(key, list, options)` is a public overload, and `TranslateOptions` has a `named` field, so a call can carry both. The list is checked first, and the named values are then left as they are. The translated string still goes through `sanitizeTranslatedHtml()` (added for CVE-2025-53892), which neutralizes event handler attributes and `javascript:` URLs. Other markup in the named values, such as links and forms, is inserted as is. Before the fix for GHSA-83rm-6c8r-g728, an `<iframe srcdoc>` in a named value also passes the sanitizer, and script runs. Versions without the sanitizer (before 9.14.5, 10.0.8 and 11.1.10, and 12.0.0-alpha.1 to alpha.3) insert the named values as HTML without any further check. `<i18n-t>` is not affected: it passes either list or named values, never both, and it does not render translations as HTML. ### PoC ```js import { createI18n } from 'vue-i18n' const i18n = createI18n({ legacy: false, locale: 'en', escapeParameter: true, messages: { en: { withList: '{0} {name}', withoutList: '{name}' } } }) const t = i18n.global.t t('withoutList', { name: '<b>x</b>' }) // &lt;b&gt;x&lt;