The locize gettext-converter library is vulnerable to prototype pollution in versions prior to 1.3.3, which allows unauthenticated attackers to corrupt the global object prototype.

This is a prototype pollution vulnerability (CWE-1321) occurring in the js2i18next function, where the library fails to sanitize input keys for proto or constructor properties. An unauthenticated attacker can supply malicious translation data to trigger this flaw, enabling the modification of process-wide object prototypes.

The ability to pollute the object prototype poses a significant risk to the integrity and availability of applications using this library. Successful exploitation can result in a denial of service by crashing the application or altering its logic to enable further unauthorized actions, justifying the high CVSS score of 8.3.

Immediate Action: Update the gettext-converter dependency to version 1.3.3 or later immediately to incorporate the necessary input sanitization.

Proactive Monitoring: Review application error logs for unexpected crashes or abnormal behavior in translation processing modules, which may indicate attempted exploitation.

Compensating Controls: Implement input validation on all untrusted translation files before they are processed by the library, ensuring that restricted object keys are rejected.

Public Exploit Available: Unknown

Given the potential for severe application impact and the existence of a proof-of-concept, users must prioritize the update of gettext-converter to version 1.3.3. Failure to patch leaves the application environment susceptible to arbitrary logic manipulation and denial of service.