AIKIDO-2026-63709

TL;DR

The PO file parser in gettext-converter assigns parsed msgctxt and msgid values onto result objects using unsafe property assignment in its normalize routine. When PO input contains a context or id such as __proto__ or constructor, parsing with po2js(), po2i18next(), or helpers built on them writes attacker-controlled properties onto Object.prototype or the global Object constructor. This pollutes inherited properties across every object in the process, which can corrupt application state, cause denial of service, or enable further attacks. The fix guards writes with own-property checks and uses Object.defineProperty so crafted keys can no longer reach the prototype chain.