{"id":"CVE-2026-55451","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-55451","summary":"gettext-converter: Prototype pollution in js2i18next() via crafted translation keys","details":"### Impact\n\n`js2i18next()` is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator (default `##`) and uses each segment as a dynamic object key while building the output object. A key whose segment is `__proto__` (e.g. `__proto__##gcPolluted`) causes the converter to resolve `Object.prototype` as the nested write target and assign the translated value onto it, polluting `Object.prototype` for the whole runtime.\n\nAny application that converts translation data (PO / i18next JS objects) originating from an untrusted or user-controlled source is affected. Prototype pollution can lead to denial of service and, depending on the surrounding application, may enable further attacks.\n\n### Patches\n\nFixed in `gettext-converter@1.3.3`. Key segments equal to `__proto__`, `constructor`, or `prototype` are now rejected before being used as dynamic object keys.\n\n### Workarounds\n\nUpgrade to `1.3.3`. If upgrading is not immediately possible, sanitize/validate translation keys before passing them to `js2i18next()` and reject any key whose `##`-separated segments include `__proto__`, `constructor`, or `prototype`.","published":"2026-08-20T20:11:13Z","modified":"2026-08-20T20:15:07.102430570Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"gettext-converter","fixedVersion":"1.3.3"}],"fix":{"url":"https://github.com/locize/gettext-converter/commit/df90c3b93e51faef68891d97b626544f619c5b31","label":"locize/gettext-converter@df90c3b"},"references":[{"type":"WEB","url":"https://github.com/locize/gettext-converter/security/advisories/GHSA-f4jp-rw7w-ccwg"},{"type":"WEB","url":"https://github.com/locize/gettext-converter/issues/15"},{"type":"WEB","url":"https://github.com/locize/gettext-converter/commit/df90c3b93e51faef68891d97b626544f619c5b31"},{"type":"PACKAGE","url":"https://github.com/locize/gettext-converter"},{"type":"WEB","url":"https://github.com/locize/gettext-converter/releases/tag/v1.3.3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-20T20:15:07.102430570Z"}}