Godot 4.x: arbitrary code execution via .po translation file Plural-Forms header
// AI summary
Godot 4.x versions from 4.1.0 through 4.7.2 have an arbitrary code execution vulnerability in the .po translation file Plural-Forms header during translation loading.
// from the source
Posted by Tomasz Kaye on Oct 26 A code-execution vulnerability in Godot 4.x translation loading was publicly disclosed on 2026-10-26 [1]. Affected versions: Godot 4.1.0 through 4.7.2. Runtime-confirmed on the official 4.7-stable export. No equivalent path found in 3.5. Description: The .po loader stores the file s Plural-Forms header without validating it against the GNU gettext grammar (core/io/translation_loader_po.cpp:232). At the first plural lookup the header is...