{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/godot-engine/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Godot Engine (4.1.0 through 4.7.2)"],"_cs_severities":["high"],"_cs_tags":["code-execution","translation","godot","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Godot Engine"],"content_html":"\u003cp\u003eA code-execution vulnerability has been identified in Godot 4.x versions 4.1.0 through 4.7.2. The vulnerability exists within the translation loading component, specifically in the parsing logic for .po (Portable Object) files. The engine fails to validate the 'Plural-Forms' header against the GNU gettext grammar within \u003ccode\u003ecore/io/translation_loader_po.cpp\u003c/code\u003e. Exploitation occurs during the first plural lookup, where a maliciously crafted header can lead to code execution. This vulnerability is not present in Godot 3.5.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution within the context of the running Godot application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all projects utilizing Godot Engine 4.1.0 through 4.7.2.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation for all external translation files (.po) loaded by the engine until a security update is applied.\u003c/li\u003e\n\u003cli\u003eMonitor for and apply upcoming patches from the Godot Engine developers for the affected 4.x versions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T22:34:54Z","date_published":"2026-10-26T22:34:54Z","id":"https://feed.craftedsignal.io/briefs/2026-10-godot-arbitrary-code-execution/","summary":"A vulnerability in the Godot 4.x .po translation file loader allows for arbitrary code execution due to improper validation of the Plural-Forms header during plural lookup operations.","title":"Godot Engine: Arbitrary code execution via .po translation file","url":"https://feed.craftedsignal.io/briefs/2026-10-godot-arbitrary-code-execution/"}],"language":"en","title":"CraftedSignal Threat Feed - Godot Engine","version":"https://jsonfeed.org/version/1.1"}