Godot Engine: Arbitrary code execution via .po translation file
A vulnerability in the Godot 4.x .po translation file loader allows for arbitrary code execution due to improper validation of the Plural-Forms header during plural lookup operations.
Triage facts
Revision 1- Applicability
- Godot Engine (4.1.0 through 4.7.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 26, 22:34 UTC
- Source quality
- A2Likely
A code-execution vulnerability has been identified in Godot 4.x versions 4.1.0 through 4.7.2. The vulnerability exists within the translation loading component, specifically in the parsing logic for .po (Portable Object) files. The engine fails to validate the 'Plural-Forms' header against the GNU gettext grammar within core/io/translation_loader_po.cpp. Exploitation occurs during the first plural lookup, where a maliciously crafted header can lead to code execution. This vulnerability is not present in Godot 3.5.
Impact
Successful exploitation allows for arbitrary code execution within the context of the running Godot application.
Recommendation
- Inventory all projects utilizing Godot Engine 4.1.0 through 4.7.2.
- Implement strict input validation for all external translation files (.po) loaded by the engine until a security update is applied.
- Monitor for and apply upcoming patches from the Godot Engine developers for the affected 4.x versions.
Immediate actions
Inventory applications using Godot 4.1.0-4.7.2
Threat Hunt
Identify applications loading external or non-signed .po files
Data: File system access logs for .po file reads, Application integrity monitoring
Mitigations
Apply future security patches for Godot 4.x as released by the maintainers
Godot Engine 4.1.0 through 4.7.2