Executive brief
gettext-converter is a JavaScript library used to convert translation files (PO format and i18next objects) for multi-language applications. The library's js2i18next() conversion function has a prototype pollution vulnerability that allows attackers to inject malicious code into the JavaScript runtime if they can control translation keys. Applications processing user-supplied or untrusted translation data are at risk of service disruption or account compromise.
Technical details
The vulnerability exists in the js2i18next() function, which splits translation keys on a separator (default ##) and uses each segment as a dynamic object key while building output objects. When a key segment equals __proto__, constructor, or prototype, the function incorrectly resolves Object.prototype as the target for assignment, polluting the shared prototype chain. This is a classic prototype pollution vulnerability (CWE-1321). The attack requires the application to pass untrusted or user-controlled translation data to js2i18next(). Attack complexity is low and no privileges are required; however, user interaction is not needed. The impact is primarily denial of service through prototype pollution side effects. Fixed in version 1.3.3, which now rejects key segments matching __proto__, constructor, or prototype before they are used as dynamic keys.
Affected products
- locize gettext-converter < 1.3.3
Timeline
- 2026-06-12: disclosed: GitHub Advisory published
- 2026-06-12: patched: Fixed in gettext-converter@1.3.3
- 2026-08-20: advisory: Advisory updated in GitHub Advisory Database