{"action":"Upgrade gettext-converter to 1.3.3 or later.","affected":[{"fixed":"1.3.3","introduced":"0"}],"component":"gettext-converter","cve_ids":["CVE-2026-55451"],"ecosystem":"npm","epss":0.00566,"exploited":false,"fixed_versions":["1.3.3"],"ghsa_id":"GHSA-f4jp-rw7w-ccwg","id":"tcs_01M5KFMFDCW8GDNNC6ZH9SNJ84","modified_at":"2026-08-20T20:26:04.313226Z","published_at":"2026-08-20T20:11:13Z","references":["https://osv.dev/vulnerability/GHSA-f4jp-rw7w-ccwg","https://github.com/locize/gettext-converter/security/advisories/GHSA-f4jp-rw7w-ccwg","https://github.com/locize/gettext-converter/issues/15","https://github.com/locize/gettext-converter/commit/df90c3b93e51faef68891d97b626544f619c5b31","https://github.com/locize/gettext-converter","https://github.com/locize/gettext-converter/releases/tag/v1.3.3"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-f4jp-rw7w-ccwg","url":"https://osv.dev/vulnerability/GHSA-f4jp-rw7w-ccwg"}],"summary":"gettext-converter: Prototype pollution in js2i18next() via crafted translation keys"}