CVE-2026-55451

gettext-converter, a JavaScript library for converting gettext (PO) and i18next translation resources, contains a prototype pollution flaw (CWE-1321) in the js2i18next() function of lib/js2i18next.js prior to version 1.3.3. The function splits nested translation keys using options.keyseparator (default "##") and writes each segment as a dynamic object key without blocking dangerous names such as __proto__, constructor, or prototype. If an application uses the converter on untrusted PO or i18next data, a key containing a __proto__ segment causes Object.assign to write attacker-controlled translated properties onto Object.prototype, polluting the process-wide prototype. Successful exploitation can cause denial of service and may enable application-dependent follow-on attacks such as logic bypasses or further code execution paths. The issue is fixed in version 1.3.3; no public proof of concept is known, it is not in CISA's KEV catalog, and no exploitation has been observed in the wild.

What to do: Upgrade gettext-converter to version 1.3.3 or later in all projects and CI pipelines that depend on it. Until patched, never run the converter on PO or i18next files from untrusted sources, and pre-filter translation keys to reject __proto__, constructor, and prototype segments. Review any services that process user-supplied translation data for signs of prototype-pollution-induced crashes or unexpected behavior.