CyberRota Analysis
AI-GeneratedThe gettext-converter library for JavaScript versions prior to 1.3.3 is vulnerable to prototype pollution due to improper handling of dynamic object keys in the js2i18next() function. This flaw allows attackers to manipulate the Object.prototype, potentially leading to denial of service and other application-specific attacks. Developers using affected versions should prioritize upgrading to version 1.3.3 or later to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next() in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without rejecting __proto__, constructor, or prototype. When an application converts untrusted PO or i18next translation data, a __proto__ segment resolves Object.prototype as the nested write target and Object.assign writes attacker-controlled translated properties onto the process-wide prototype. The resulting prototype pollution can cause denial of service and may enable application-dependent follow-on attacks. This issue is fixed in version 1.3.3.