# CVE-2026-55451

## Summary

- **CVE ID:** CVE-2026-55451
- **Severity:** HIGH
- **CVSS Score:** 8.3 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N)
- **CWE:** CWE-1321
- **Published:** Sep 14, 2026
- **Last Modified:** Sep 14, 2026

## Description

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next() in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without rejecting __proto__, constructor, or prototype. When an application converts untrusted PO or i18next translation data, a __proto__ segment resolves Object.prototype as the nested write target and Object.assign writes attacker-controlled translated properties onto the process-wide prototype. The resulting prototype pollution can cause denial of service and may enable application-dependent follow-on attacks. This issue is fixed in version 1.3.3.

## Affected Products

- locize — gettext-converter (< 1.3.3)

## References

- [CNA](https://github.com/locize/gettext-converter/security/advisories/GHSA-f4jp-rw7w-ccwg)
- [CNA](https://github.com/locize/gettext-converter/issues/15)
- [CNA](https://github.com/locize/gettext-converter/commit/df90c3b93e51faef68891d97b626544f619c5b31)
- [CNA](https://github.com/locize/gettext-converter/releases/tag/v1.3.3)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.41%
- **EPSS Percentile:** 35.1

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._