Godot Engine (4.1.0 Through 4.7.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/godot-engine-4.1.0-through-4.7.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 26 Oct 2026 22:34:54 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGodot Engine: Arbitrary code execution via .po translation filehttps://feed.craftedsignal.io/briefs/2026-10-godot-arbitrary-code-execution/Mon, 26 Oct 2026 22:34:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-godot-arbitrary-code-execution/A vulnerability in the Godot 4.x .po translation file loader allows for arbitrary code execution due to improper validation of the Plural-Forms header during plural lookup operations.A code-execution vulnerability has been identified in Godot 4.x versions 4.1.0 through 4.7.2. The vulnerability exists within the translation loading component, specifically in the parsing logic for .po (Portable Object) files. The engine fails to validate the 'Plural-Forms' header against the GNU gettext grammar within core/io/translation_loader_po.cpp. Exploitation occurs during the first plural lookup, where a maliciously crafted header can lead to code execution. This vulnerability is not present in Godot 3.5.

Impact

Successful exploitation allows for arbitrary code execution within the context of the running Godot application.

Recommendation

  • Inventory all projects utilizing Godot Engine 4.1.0 through 4.7.2.
  • Implement strict input validation for all external translation files (.po) loaded by the engine until a security update is applied.
  • Monitor for and apply upcoming patches from the Godot Engine developers for the affected 4.x versions.
]]>highadvisorycode-executiontranslationgodotvulnerability