MEDIUM GitHub
CVE-2026-55451
gettext-converter: Prototype pollution in js2i18next() via crafted translation keys
### Impact
`js2i18next()` is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator (default `##`) and uses each segment as a dynamic object key while building the output object. A key whose segment is `__proto__` (e.g. `__proto__##gcPolluted`) causes the converter to resolve `Object.prototype` as the nested write target and assign the translated value onto it, polluting `Object.prototype` for the whole runtime.
Any application that converts
Affected Products
- npm/gettext-converter < 1.3.3
References
- https://github.com/advisories/GHSA-f4jp-rw7w-ccwg
- https://github.com/locize/gettext-converter/security/advisories/GHSA-f4jp-rw7w-ccwg
- https://github.com/locize/gettext-converter/issues/15
- https://github.com/locize/gettext-converter/commit/df90c3b93e51faef68891d97b626544f619c5b3
This medium severity vulnerability was published on 2026-08-20 via GitHub. Affected: npm/gettext-converter < 1.3.3.
vulnfeed aggregates 11796 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.