gettext.js is a GNU gettext port for node and the browser. There is a cross-site scripting (XSS) injection if `.po` dictionary definition files are corrupted. This vulnerability has been patched in version 2.0.3. As a workaround, control the origin of the definition catalog to prevent the use of this flaw in the definition of plural forms.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| gettext.js(npm) | 0 | 2.0.3 | N/A |
CVSS Metrics
