{"id":"CVE-2026-55451","title":"gettext-converter provides gettext resource conversion utilities for JavaScript","summary":"gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next() in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number sign…","severity":"high","cvss":8.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":["CWE-1321","CWE-915"],"vendor":"locize","product":"gettext-converter","affected":["gettext-converter < 1.3.3"],"patched":["gettext-converter 1.3.3"],"published":"2026-09-14","updated":"2026-09-14","sourceUpdated":"2026-09-14T19:17:32.213","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55451","references":[{"url":"https://github.com/locize/gettext-converter/commit/df90c3b93e51faef68891d97b626544f619c5b31","label":"security-advisories@github.com"},{"url":"https://github.com/locize/gettext-converter/issues/15","label":"security-advisories@github.com"},{"url":"https://github.com/locize/gettext-converter/releases/tag/v1.3.3","label":"security-advisories@github.com"},{"url":"https://github.com/locize/gettext-converter/security/advisories/GHSA-f4jp-rw7w-ccwg","label":"security-advisories@github.com"},{"url":"https://github.com/locize/gettext-converter/issues/15","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-f4jp-rw7w-ccwg"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55451.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-55451"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533213"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55451"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55451"}],"tags":["nvd","cve.org","exploit-available","ghsa","npm","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-14T18:53:33.771788Z"},"cvssSource":"cna","aliases":["GHSA-f4jp-rw7w-ccwg"],"ecosystem":"npm","ingestedAt":"2026-08-20T21:01:37.111Z","epss":0.00414,"epssPercentile":0.35246,"scores":{"cna":8.3,"vendor":8.2},"slug":"CVE-2026-55451","body":"## Overview\n\ngettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next() in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without rejecting __proto__, constructor, or prototype. When an application converts untrusted PO or i18next translation data, a __proto__ segment resolves Object.prototype as the nested write target and Object.assign writes attacker-controlled translated properties onto the process-wide prototype. The resulting prototype pollution can cause denial of service and may enable application-dependent follow-on attacks. This issue is fixed in version 1.3.3.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55451)\n\nAffected packages:\n\n- `gettext-converter < 1.3.3`\n\nPatched in:\n\n- `gettext-converter 1.3.3`\n\nSource: https://github.com/advisories/GHSA-f4jp-rw7w-ccwg\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4 · no fix planned: Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4 · updated 2026-09-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55451.json)","depth":"midnight","depthScore":58,"depthScoreParts":{"impact":45.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":203163,"id":"CVE-2026-55451","ts":1789413239552,"field":"exploit_available","old":"false","new":"true"},{"seq":203090,"id":"CVE-2026-55451","ts":1789409572595,"field":"cvss","old":null,"new":"8.3"},{"seq":203089,"id":"CVE-2026-55451","ts":1789409572595,"field":"severity","old":"medium","new":"high"}]}