Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
php-gettext/gettext
master @ 73ee581
1
Fixes
2
CVEs
CRITICAL
Peak severity
Highlights
Remote Code Execution: 1 prior fix. Scrutinize any change in this area.
src/Translator.php: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Remote Code Execution: The translation engine processes plural form formulas by executing them dynamically. Without rigid validation, malicious language files containing crafted plural formulas can execute arbitrary PHP code under the application context.
Memory Corruption (Double Free): A double free vulnerability in the underlying parser component (as seen in CVE-2018-18751) allows attackers to cause memory corruption or application crashes via malformed PO file inputs.
Insecure Temporary Files: Insecure temporary file handling in helper scripts allows local symlink attacks, enabling privilege escalation or unauthorized file overwrites on the local system.