GHSA-vwhg-jwr4-vxgg
gettext.js has a Cross-site Scripting injection
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | gettext.js | < 2.0.3 | 2.0.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Possible vulnerability to XSS injection if .po dictionary definition files is corrupted
### Patches
Update gettext.js to 2.0.3
### Workarounds
Make sure you control the origin of the definition catalog to prevent the use of this flaw in the definition of plural forms.
References
External links from the advisory. They lead to third-party sites.