GHSA-f4jp-rw7w-ccwg: Npm/gettext-converter vulnerability
Impact
js2i18next() is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator (default ##) and uses each segment as a dynamic object key while building the output object. A key whose segment is proto (e.g. proto##gcPolluted) causes the converter to resolve Object.prototype as the nested write target and assign the translated value onto it, polluting Object.prototype for the whole runtime.
Any application that converts translation data (PO / i18next JS objects) originating from an untrusted or user-controlled source is affected. Prototype pollution can lead to denial of service and, depending on the surrounding application, may enable further attacks.
Patches
Fixed in gettext-converter@1.3.3. Key segments equal to proto, constructor, or prototype are now rejected before being used as dynamic object keys.
Workarounds
Upgrade to 1.3.3. If upgrading is not immediately possible, sanitize/validate translation keys before passing them to js2i18next() and reject any key whose ##-separated segments include proto, constructor, or prototype.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/gettext-converterto a version that resolves this vulnerability.Fixed in 1.3.3 - Upgrade
Upgrade
gettext-converterto a version that resolves this vulnerability.Fixed in 1.3.3 - Configuration
Before passing translation keys to js2i18next(), sanitize/validate translation keys and reject any key where any segment (split by the key separator, default `##`) equals or includes `__proto__`, `constructor`, or `prototype`.
gettext-converter (js2i18next/js2i18next conversion flow) translation key validation for dynamic object segments = reject any key whose ##-separated segments include __proto__, constructor, or prototype
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications are affected when they pass translation data from an untrusted or user-controlled source into js2i18next(). Translation data may be PO input or i18next JavaScript objects.
What input is needed to exploit the vulnerability?
An attacker needs to supply a translation key containing a dangerous segment after splitting on the key separator, which defaults to ##. For example, __proto__##gcPolluted causes a write to Object.prototype.
Are default settings affected?
Yes. The default key separator is ##, so a key such as __proto__##gcPolluted is sufficient when untrusted translation keys are converted.
What can be done if upgrading is not immediately possible?
Validate or sanitize translation keys before passing them to js2i18next(). Reject keys with any ##-separated segment equal to __proto__, constructor, or prototype.
How can I determine whether a deployment has a fix?
The issue is fixed in gettext-converter version 1.3.3. The fix rejects __proto__, constructor, and prototype segments before they are used as dynamic object keys.