CVE-2026-55451

A flaw was found in gettext-converter. This vulnerability, known as prototype pollution, occurs in the js2i18next function when processing untrusted translation data. An attacker can craft malicious translation keys containing proto to modify the global Object.prototype. This can lead to a denial...

CVE-2026-55451

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without...

CVE-2026-55451 gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without...

CVE-2026-55451 gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without...

CVE-2026-55451 gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without...

EUVD-2026-77634

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without...

CVE-2026-55451

CVE-2026-55451 is a prototype pollution vulnerability in gettext-converter (NPM, versions ≥1.0.3, ≤1.3.2). The js2i18next() function in lib/js2i18next.js splits nested translation keys on the key separator (default ##) and uses each segment as a dynamic object key without rejecting __proto__, con...

Security Bulletin: IBM DataPower Gateway affected by use after free in Grub (CVE-2025-61662)

Summary IBM DataPower Gateway has addressed CVE-2025-61662 in version 11.0.0.2 Vulnerability Details CVEID:CVE-2025-61662 DESCRIPTION: A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered...

Astra Linux – Vulnerability in grub2

A vulnerability related to operations after freeing memory has been discovered in GRUB’s gettext module. This flaw arises from a programming error where the gettext command remains registered in memory even after its associated module is unloaded. An attacker can exploit this condition by invokin...

CVE-2026-55451: Improperly Controlled Modification of Object Prototype Attributes

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without...

VulnCheck KEV: CVE-2026-75981

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '!trpst' and '!trpen' are unconditionally rewritten to '' by translatepage in...

NPM: gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

NPM: gettext-converter: Prototype pollution in js2i18next via crafted translation keys vulnerability discovered by ? in WordPress Npm gettext-converter versions 1.3.3...

gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

Impact js2i18next is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator default and uses each segment as a dynamic object key while building the output object. A key whose segment is proto e.g. protogcPolluted causes the converter to resolv...

@gluuten/gluuten-cli (0.9.5), @open-xchange/vite-plugin-i18next-gettext (>=0.0.1, <=0.0.4) +2 more potentially affected by CVE-2026-55451 via gettext-converter (>=1.0.3, <=1.3.2)

gettext-converter NPM version =1.0.3, =0.0.1, =7.1.0, =4.11.2, =4.18.0 Source cves: CVE-2026-55451 Source advisory: OSV:GHSA-F4JP-RW7W-CCWG...

GHSA-F4JP-RW7W-CCWG gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

Impact js2i18next is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator default and uses each segment as a dynamic object key while building the output object. A key whose segment is proto e.g. protogcPolluted causes the converter to resolv...

PT-2026-80769

Impact js2i18next is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator default and uses each segment as a dynamic object key while building the output object. A key whose segment is proto e.g. proto gcPolluted causes the converter to resol...

CVE-2026-75981 TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '!trpst' and '!trpen' are unconditionally rewritten to '' by translatepage in...

PT-2026-78311

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '!trpst' and '!trpen' are unconditionally rewritten to '' by translate page in...

CVE-2026-75981: Improper Neutralization of Input During Web Page Generation

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '!trpst' and '!trpen' are unconditionally rewritten to '' by translatepage in...

appfinder (>=0.1.0, <=0.1.2), breezy (3.3.4) +25 more potentially affected by unknown CVE via gettext-rs (>=0.4.4, <=0.7.7)

gettext-rs CARGO version =0.4.4, =0.1.0, =0.0.4, =0.4.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.2.0, =0.0.7, =1.1.0, =0.1.0, =0.5.0, =0.5.0, =0.6.4 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0244...