What’s Vulnerable › Vulnerabilities

CVE-2026-55451: gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

• Severity: high (CVSS 8.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-30
• Weakness: CWE-1321

Description

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next() in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without rejecting __proto__, constructor, or prototype. When an application converts untrusted PO or i18next translation data, a __proto__ segment resolves Object.prototype as the nested write target and Object.assign writes attacker-controlled translated properties onto the process-wide prototype. The resulting prototype pollution can cause denial of service and may enable application-dependent follow-on attacks. This issue is fixed in version 1.3.3.

Affected products

• locize gettext-converter: before 1.3.3

References

• https://github.com/locize/gettext-converter/commit/df90c3b93e51faef68891d97b626544f619c5b31
• https://github.com/locize/gettext-converter/issues/15
• https://github.com/locize/gettext-converter/releases/tag/v1.3.3
• https://github.com/locize/gettext-converter/security/advisories/GHSA-f4jp-rw7w-ccwg
• https://github.com/locize/gettext-converter/issues/15

Get alerted when CVE-2026-55451 or the next vulnerability affects your stack