CVE-2024-43370

What it actually does

Corrupted .po dictionary files allow injection of arbitrary JavaScript into plural-form definitions that are later rendered without sanitization, resulting in reflected or stored XSS in applications using the library.

Why it matters to the business

Attackers can execute scripts in users' browsers, potentially stealing session data, performing unauthorized actions, or defacing pages served by applications that consume untrusted translation catalogs.

How an attack unfolds

An attacker crafts a malicious .po file containing JavaScript in a plural-forms header, hosts or supplies it to the target application, and waits for the gettext.js library to parse and render the corrupted definition, executing the payload in the victim's browser context.

How to fix it

Upgrade guillaumepotier/gettext.js to version 2.0.3 or later (commit 5d18cb4e512eba1210ab7cead968ed85483323e4). As a temporary control, ensure all .po catalog files originate from trusted, authenticated sources only.

How to confirm the fix worked

Verify the installed package version or commit hash matches the fixed release; test by loading a known-malicious .po file and confirming that script execution is blocked.

Typical attack path

1. Identify an application that loads .po catalogs from an attacker-influenced source
2. Craft a .po file with JavaScript payload inside the Plural-Forms header
3. Deliver the file via upload, supply-chain substitution, or MITM on catalog retrieval
4. Trigger catalog loading in a victim browser session
5. Execute arbitrary client-side code via the unsanitized plural-form evaluation

How to detect it

Search web server and application logs for unexpected plural-forms values containing script tags or event handlers; monitor for unusual JavaScript execution originating from translation catalog parsing.

What your security team should do

• Immediately audit all applications for direct or transitive use of gettext.js and schedule upgrades to the fixed commit
• Implement origin validation and integrity checks on all translation catalog files before parsing
• Add automated dependency scanning to CI pipelines to block future vulnerable versions
• Review and restrict any user-supplied or third-party .po file ingestion paths