Vendor
A vulnerability in the Godot 4.x .po translation file loader allows for arbitrary code execution due to improper validation of the Plural-Forms header during plural lookup operations.