CVE-2026-55451 Details
Description
gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next() in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without rejecting __proto__, constructor, or prototype. When an application converts untrusted PO or i18next translation data, a __proto__ segment resolves Object.prototype as the nested write target and Object.assign writes attacker-controlled translated properties onto the process-wide prototype. The resulting prototype pollution can cause denial of service and may enable application-dependent follow-on attacks. This issue is fixed in version 1.3.3.
A prototype pollution vulnerability has been identified in the gettext-converter package, specifically in version 1.3.2 and prior. The issue arises within the js2i18next function, where translation keys containing the default key separator ('##') and starting with '__proto__' can manipulate the Object.prototype. This occurs because the function uses these keys to dynamically assign values, leading to potential denial-of-service conditions and application-specific follow-on attacks. The vulnerability is exploitable when an application processes untrusted translation data from PO or i18next sources.
Upgrade to gettext-converter version 1.3.3 or later. If an immediate upgrade is not possible, sanitize translation keys to remove any segments that could cause prototype pollution before using them with the js2i18next function.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/locize/gettext-converter/issues/15 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/locize/gettext-converter/commit/df90c3b93e51faef68891d97b626544f619c5b31 | [email protected] | Source CodeVendor |
| https://github.com/locize/gettext-converter/issues/15 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/locize/gettext-converter/releases/tag/v1.3.3 | [email protected] | Release NotesVendor |
| https://github.com/locize/gettext-converter/security/advisories/GHSA-f4jp-rw7w-ccwg | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gettext-converter | < 1.3.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |