Vulnerability · Published Sep 14, 2026 · Assigned by GitHub_M
CVE-2026-55451gettext-converter: Prototype pollution in js2i18next() via crafted translation keys
High 8.3
In plain English
A high-severity prototype pollution in gettext-converter from locize. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next() in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without rejecting __proto__, constructor, or prototype. When an application converts untrusted PO or i18next translation data, a __proto__ segment resolves Object.prototype as the nested write target and Object.assign writes attacker-controlled translated properties onto the process-wide prototype. The resulting prototype pollution can cause denial of service and may enable application-dependent follow-on attacks. This issue is fixed in version 1.3.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | gettext-converter | 1.3.3 | GHSA-f4jp-rw7w-ccwg |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| locize | gettext-converter | < 1.3.3 |
Weakness: CWE-1321 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/locize/gettext-converter/security/advisories/GHSA-f4jp-rw7w-ccwg x_refsource_CONFIRM
- https://github.com/locize/gettext-converter/issues/15 x_refsource_MISC
- https://github.com/locize/gettext-converter/commit/df90c3b93e51faef68891d97b626544f619c5b31 x_refsource_MISC
- https://github.com/locize/gettext-converter/releases/tag/v1.3.3 x_refsource_MISC