gettext-converter CVE-2026-55451
MEDIUM
GHSA-f4jp-rw7w-ccwg
Severity by source
Network-delivered untrusted translation input; S:C because Object.prototype pollution corrupts the entire Node.js runtime beyond the library boundary.
Lifecycle Timeline
2Blast Radius
ecosystem impact- 1 npm packages depend on gettext-converter (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.3.3.
DescriptionCVE.org
Impact
js2i18next() is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator (default ##) and uses each segment as a dynamic object key while building the output object. A key whose segment is __proto__ (e.g. __proto__##gcPolluted) causes the converter to resolve Object.prototype as the nested write target and assign the translated value onto it, polluting Object.prototype for the whole runtime.
Any application that converts translation data (PO / i18next JS objects) originating from an untrusted or user-controlled source is affected. Prototype pollution can lead to denial of service and, depending on the surrounding application, may enable further attacks.
Patches
Fixed in gettext-converter@1.3.3. Key segments equal to __proto__, constructor, or prototype are now rejected before being used as dynamic object keys.
Workarounds
Upgrade to 1.3.3. If upgrading is not immediately possible, sanitize/validate translation keys before passing them to js2i18next() and reject any key whose ##-separated segments include __proto__, constructor, or prototype.
AnalysisAI
Prototype pollution in the gettext-converter npm library's js2i18next() function enables an attacker who can supply crafted translation data to write arbitrary values onto Object.prototype, corrupting the shared prototype chain for the entire Node.js runtime. All versions of gettext-converter below 1.3.3 are vulnerable when the consuming application passes PO or i18next JS translation objects from an untrusted or user-controlled source to the function. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the application passes translation data originating from an untrusted or user-controlled source to js2i18next(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS score was provided with this advisory; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L, estimating roughly a High-severity base score, reflecting a typical network-delivery scenario for untrusted translation data with runtime-wide scope impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade gettext-converter to version 1.3.3 or later using npm install gettext-converter@1.3.3 or yarn add gettext-converter@1.3.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today