{"id":"CVE-2026-55451","revision":"1fb0bd7acb364ae3a429ac53494ef5f2","records":[{"revision":"1fb0bd7acb364ae3a429ac53494ef5f2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-55451","aliases":[],"title":"gettext-converter: Prototype pollution in js2i18next() via crafted translation keys","description":"gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next() in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without rejecting __proto__, constructor, or prototype. When an application converts untrusted PO or i18next translation data, a __proto__ segment resolves Object.prototype as the nested write target and Object.assign writes attacker-controlled translated properties onto the process-wide prototype. The resulting prototype pollution can cause denial of service and may enable application-dependent follow-on attacks. This issue is fixed in version 1.3.3.","state":0,"publishedAt":"2026-09-14T16:49:36.238+00:00","modifiedAt":"2026-09-14T18:53:39.96+00:00","affected":[{"ecosystem":"Vendor product","name":"gettext-converter","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"locize\",\n                    \"product\": \"gettext-converter\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.3.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.3,"severity":"HIGH"}],"references":["https://github.com/locize/gettext-converter/security/advisories/GHSA-f4jp-rw7w-ccwg","https://github.com/locize/gettext-converter/issues/15","https://github.com/locize/gettext-converter/commit/df90c3b93e51faef68891d97b626544f619c5b31","https://github.com/locize/gettext-converter/releases/tag/v1.3.3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-55451","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-55451","identifiers":["CVE-2026-55451"]},"retained":false,"historicalAffected":[]}],"coverage":[]}