GHSA-g974-hxvm-x689

node-gettext vulnerable to Prototype Pollution

Source: GitHub Advisory Database (reviewed) High CVE-2024-21528

Packages

Ecosystem	Package	Affected	Fixed in
npm	node-gettext	<= 3.0.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improper user input sanitization.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-21528 advisory
https://github.com/alexanderwallin/node-gettext package
https://github.com/alexanderwallin/node-gettext/blob/65d9670f691c2eeca40dce129c95bcf8b613d344/lib/gettext.js#L113 web
https://security.snyk.io/vuln/SNYK-JS-NODEGETTEXT-6100943 web