gettext-converter CVE-2026-55451

Exploitation requires that the application passes translation data originating from an untrusted or user-controlled source to js2i18next(). The attacker must be able to inject a translation key that, when split on the '##' separator (the library's default), yields '__proto__', 'constructor', or 'prototype' as one of the resulting segments - for example, a key literally named '__proto__##anyProperty'. No special server configuration or non-default library option is required because '##' is the default key separator; however, if the consuming application overrides the separator to a different character, the attacker must craft the key using that alternative separator instead. Applications that load translation files only from developer-controlled, static, or build-time sources are not practically exploitable regardless of library version. What limits exploitation: the application must actively accept and process external translation input (uploaded PO files, API-submitted i18next JSON, user-editable localization strings); absent that workflow, the vulnerable code path is never reached. Authentication requirements are not independently confirmable from available data - they depend entirely on how the consuming application gates access to the translation-ingestion endpoint.

No CVSS score was provided with this advisory; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L, estimating roughly a High-severity base score, reflecting a typical network-delivery scenario for untrusted translation data with runtime-wide scope impact. No EPSS score is available. The vulnerability is not listed in CISA KEV and no public proof-of-concept exploit is identified at time of analysis - these two signals together suggest no confirmed opportunistic exploitation. Real-world risk is highly context-dependent: applications that load translations exclusively from developer-controlled or build-time sources are not practically exploitable regardless of library version, which substantially limits the realistic attack surface. Applications exposing a translation-upload API, a localization management interface, or any endpoint that accepts user-supplied PO or i18next JSON files represent the highest-risk scenario. Prototype pollution as a vulnerability class is well-understood and has a documented history of enabling downstream privilege escalation when polluted properties intersect with authorization or configuration logic, so the 'further attacks' caveat in the advisory is credible. The patch is available, trivial to apply, and independently confirmed in the commit diff and CHANGELOG; the primary driver for urgency is whether untrusted translation input is part of the application's supported workflow.

An attacker submits a crafted PO or i18next JSON payload to an application that exposes a translation-upload or localization API backed by gettext-converter. The payload contains a key such as '__proto__##isAdmin' with value 'true'; when js2i18next() processes this key it splits on '##', resolves '__proto__' to Object.prototype, and writes the value, causing every subsequently created or accessed object in the runtime to inherit isAdmin as true. Depending on application logic this could bypass role checks, corrupt configuration objects, or cause uncaught exceptions that crash the service.