{"id":"GHSA-f4jp-rw7w-ccwg","summary":"gettext-converter: Prototype pollution in js2i18next() via crafted translation keys","details":"### Impact\n\n`js2i18next()` is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator (default `##`) and uses each segment as a dynamic object key while building the output object. A key whose segment is `__proto__` (e.g. `__proto__##gcPolluted`) causes the converter to resolve `Object.prototype` as the nested write target and assign the translated value onto it, polluting `Object.prototype` for the whole runtime.\n\nAny application that converts translation data (PO / i18next JS objects) originating from an untrusted or user-controlled source is affected. Prototype pollution can lead to denial of service and, depending on the surrounding application, may enable further attacks.\n\n### Patches\n\nFixed in `gettext-converter@1.3.3`. Key segments equal to `__proto__`, `constructor`, or `prototype` are now rejected before being used as dynamic object keys.\n\n### Workarounds\n\nUpgrade to `1.3.3`. If upgrading is not immediately possible, sanitize/validate translation keys before passing them to `js2i18next()` and reject any key whose `##`-separated segments include `__proto__`, `constructor`, or `prototype`.","aliases":["CVE-2026-55451"],"modified":"2026-08-20T20:26:18.214365Z","published":"2026-08-20T20:11:13Z","database_specific":{"cwe_ids":["CWE-1321"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-08-20T20:11:13Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/locize/gettext-converter/security/advisories/GHSA-f4jp-rw7w-ccwg"},{"type":"WEB","url":"https://github.com/locize/gettext-converter/issues/15"},{"type":"WEB","url":"https://github.com/locize/gettext-converter/commit/df90c3b93e51faef68891d97b626544f619c5b31"},{"type":"PACKAGE","url":"https://github.com/locize/gettext-converter"},{"type":"WEB","url":"https://github.com/locize/gettext-converter/releases/tag/v1.3.3"}],"affected":[{"package":{"name":"gettext-converter","ecosystem":"npm","purl":"pkg:npm/gettext-converter"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-f4jp-rw7w-ccwg/GHSA-f4jp-rw7w-ccwg.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}