Unpatched Godot 4 flaw lets a community .po translation file run attacker-chosen code inside exported games

In Godot Engine 4.1.0 through 4.7.2, the Plural-Forms header of a gettext .po translation file is not checked and is evaluated by the engine's general Expression evaluator. A crafted header can deserialize a GDScript object (via bytes_to_var_with_objects) whose script source the attacker controls. That script then runs inside the game process, with the game's privileges, the first time the game shows a pluralized string. At risk: any Godot 4 game that ships or loads community or third-party translations, and the players who install them. The researcher (Tomasz Kaye) confirmed it at runtime on the official 4.7-stable export and published a public PoC. Disclosed 2026-10-26. Still unpatched as of 2026-10-26: maintainer PRs #123130 and #123857 are not merged. A CVE has been requested. No exploitation in the wild reported.

Summary written from the sources below. Check the originals before acting.