Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

gettext-converter can let attackers change program behavior

CVE-2026-55451 · published 28 days ago
Summary

Versions of gettext-converter before 1.3.3 let specially crafted translation files modify the core structure of a JavaScript program. This can cause the program to crash or open the door to further attacks. Update to version 1.3.3 or later to stop the problem.

What to do
  • Update adrai gettext-converter to version 1.3.3.
Affected software
Ecosystem VendorProductAffected versions
– locize gettext-converter < 1.3.3
npm adrai gettext-converter < 1.3.3
Fix: upgrade to 1.3.3
Original advisory text
gettext-converter: Prototype pollution in js2i18next() via crafted translation keys
gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next() in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without rejecting __proto__, constructor, or prototype. When an application converts untrusted PO or i18next translation data, a __proto__ segment resolves Object.prototype as the nested write target and Object.assign writes attacker-controlled translated properties onto the process-wide prototype. The resulting prototype pollution can cause denial of service and may enable application-dependent follow-on attacks. This issue is fixed in version 1.3.3.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-1321Prototype Pollution
Timeline
Published14 Sep 2026
Updated11 Oct 2026
First seen20 Aug 2026
Sources
GHSA-f4jp-rw7w-ccwg · GHSA
CVE-2026-55451 · NVD
GHSA-f4jp-rw7w-ccwg · OSV
CVE-2026-55451 · MITRE
CVE-2026-55451 · OSV
Track software like this
Free during beta