Prototype Pollution in gettext-converter via __proto__

Executive Summary

This vulnerability is a prototype pollution issue in the gettext-converter library affecting versions prior to 1.3.3. The js2i18next() function splits translation keys using the default separator ## and uses segments as object keys without sanitizing unsafe values like __proto__. When an attacker crafts a key starting with __proto__, it modifies Object.prototype, allowing arbitrary property injection via Object.assign(). This can disrupt application behavior or enable further attacks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect applications using gettext-converter versions prior to 1.3.3. Check if translation keys contain segments like __proto__, constructor, or prototype. Review logs for Object.prototype modifications or unexpected property assignments.

Useful 0 Not Useful 0

Impact Analysis

If you use a vulnerable version of gettext-converter to process untrusted translation data, an attacker could pollute Object.prototype. This may cause denial of service by breaking application logic or enable follow-on attacks like property injection, leading to unexpected behavior, crashes, or security bypasses in your application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling prototype pollution attacks that modify global objects. Such attacks may lead to denial of service or unauthorized data access, potentially violating integrity and availability requirements in these regulations. However, the CVE itself does not explicitly address compliance implications.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade gettext-converter to version 1.3.3 or later. If upgrading is not possible, sanitize translation keys by rejecting segments like __proto__, constructor, or prototype before processing. Avoid using untrusted translation data.

Useful 0 Not Useful 0