Godot 4.1.0–4.7.2: code execution via .po Plural-Forms header
Original title: Godot 4.x: arbitrary code execution via .po translation file Plural-Forms header
The .po loader stores an unvalidated Plural-Forms header; it was runtime-confirmed on official 4.7-stable and not found in 3.5.
A code-execution flaw in Godot 4.x translation loading was publicly disclosed on October 26. Godot 4.1.0 through 4.7.2 is affected. The .po loader stores the Plural-Forms header without checking it against the GNU gettext grammar, and that header is used at the first plural lookup. The excerpt does not name a fixed release.
Unconfirmed: The post is truncated before the full trigger, and no fixed version is stated.
- Affected versions are Godot 4.1.0 through 4.7.2.
- Runtime-confirmed on the official 4.7-stable export.
- No equivalent path was found in Godot 3.5.
- The store is in core/io/translation_loader_po.cpp at line 232.
Impact: arbitrary code execution via a crafted .po file
| Product | Affected |
|---|---|
| Godot | 4.1.0 through 4.7.2 |
From the original article
Posted by Tomasz Kaye on Oct 26 A code-execution vulnerability in Godot 4. x translation loading was publicly disclosed on 2026-10-26 [1]. Affected versions: Godot 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.