CVE-2026-55451

CVE-2026-55451 · gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next() in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without rejecting __proto__, constructor, or prototype. When an application converts untrusted PO or i18next translation data, a __proto__ segment resolves Object.prototype as the nested write target and Object.assign writes attacker-controlled translated properties onto the process-wide prototype. The resulting prototype pollution can cause denial of service and may enable application-dependent follow-on attacks. This issue is fixed in version 1.3.3.

CVSS 8.3 · Высокий · EPSS 0,6% · Есть исправление

Опубликовано

2026-09-14T16:49:36.238Z

Обновлено

2026-09-14T18:53:39.960Z

Стек: node

Проверьте свой сервер →