high5.9
CVE-2024-21528
node-gettext vulnerable to Prototype Pollution
Impact
All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improper user input sanitization.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | node-gettext | <= 3.0.0 | none recorded |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/alexanderwallin/node-gettext/blob/65d9670f691c2eeca40dce129c95bcf8b613d344/lib/gettext.js%23L113
- https://security.snyk.io/vuln/SNYK-JS-NODEGETTEXT-6100943
- https://github.com/advisories/GHSA-g974-hxvm-x689
- https://nvd.nist.gov/vuln/detail/CVE-2024-21528
- https://github.com/alexanderwallin/node-gettext/blob/65d9670f691c2eeca40dce129c95bcf8b613d344/lib/gettext.js#L113