gettext-converter is a JavaScript utility for converting gettext resources. In versions before 1.3.3, the js2i18next() function in lib/js2i18next.js splits nested translation keys by a key separator and uses each segment as a dynamic object key without filtering out dangerous keys like __proto__, constructor, or prototype. When untrusted translation data containing a __proto__ segment is processed, it results in prototype pollution by assigning attacker-controlled properties to Object.prototype. This vulnerability can cause denial of service and may enable further attacks depending on the application context. The vulnerability is addressed in version 1.3.3.

Exploitation of this vulnerability allows an attacker to perform prototype pollution by injecting properties into Object.prototype. This can cause denial of service and may facilitate additional application-specific attacks. The vulnerability affects all applications using vulnerable versions of gettext-converter that process untrusted translation data with js2i18next().

Upgrade gettext-converter to version 1.3.3 or later, where this prototype pollution vulnerability is fixed. No other mitigations are specified or required if the upgrade is applied.