Prototype Pollution Vulnerability in gettext-converter by Locize

CVE-2026-55451

What is CVE-2026-55451?

The gettext-converter library, used for converting gettext resources in JavaScript, contains a vulnerability that allows for prototype pollution. This occurs in the js2i18next() function, where the default key separator can be exploited by untrusted translation data, leading to potential write access to the Object.prototype. Exploiting this vulnerability can result in denial of service and may allow adversaries to execute follow-on attacks that leverage the manipulated prototype. This issue has been resolved in version 1.3.3.

References