Cyber ·
Godot 4.x: arbitrary code execution via Plural-Forms header in .po translation files
Vulnerability disclosed on 26 October 2026 in loading .po translations in Godot 4.x, versions 4.1.0 to 4.7.2. Confirmed at runtime in the official 4.7-stable export. No equivalent path was found in version 3.5.
The advisory describes a code execution vulnerability in loading translations in Godot 4.x, publicly disclosed on 26 October 2026 through the oss-sec feed. Affected versions are 4.1.0 to 4.7.2. According to the text, the flaw was confirmed at runtime in the official 4.7-stable export, and no equivalent path was found in version 3.5.
The issue lies in the .po file loader, which stores the Plural-Forms header without validating it against the GNU gettext grammar (core/io/translation_loader_po.cpp:232). On the first plural lookup, the header is processed, and the advisory indicates that this is where code execution occurs. The text we received is truncated, so the full details should be read in the original source.
To consult and verify, locate the original message in the public oss-sec feed archive, check the date and the list of affected versions, and compare them with the official Godot release notes. For your environment, list the Godot versions in use, update to a fixed release as indicated by the vendor, and treat .po files from external sources as untrusted input.