{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "gettext-converter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55451"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T20:11:13Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\n`js2i18next()` is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator (default `##`) and uses each segment as a dynamic object key while building the output object. A key whose segment is `__proto__` (e.g. `__proto__##gcPolluted`) causes the converter to resolve `Object.prototype` as the nested write target and assign the translated value onto it, polluting `Object.prototype` for the whole runtime.\n\nAny application that converts translation data (PO / i18next JS objects) originating from an untrusted or user-controlled source is affected. Prototype pollution can lead to denial of service and, depending on the surrounding application, may enable further attacks.\n\n### Patches\n\nFixed in `gettext-converter@1.3.3`. Key segments equal to `__proto__`, `constructor`, or `prototype` are now rejected before being used as dynamic object keys.\n\n### Workarounds\n\nUpgrade to `1.3.3`. If upgrading is not immediately possible, sanitize/validate translation keys before passing them to `js2i18next()` and reject any key whose `##`-separated segments include `__proto__`, `constructor`, or `prototype`.",
  "id": "GHSA-f4jp-rw7w-ccwg",
  "modified": "2026-08-20T20:11:13Z",
  "published": "2026-08-20T20:11:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/locize/gettext-converter/security/advisories/GHSA-f4jp-rw7w-ccwg"
    },
    {
      "type": "WEB",
      "url": "https://github.com/locize/gettext-converter/issues/15"
    },
    {
      "type": "WEB",
      "url": "https://github.com/locize/gettext-converter/commit/df90c3b93e51faef68891d97b626544f619c5b31"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/locize/gettext-converter"
    },
    {
      "type": "WEB",
      "url": "https://github.com/locize/gettext-converter/releases/tag/v1.3.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "gettext-converter: Prototype pollution in js2i18next() via crafted translation keys"
}