---
id: "TECH-202610-unpatched-godot-4-flaw-lets-a-community-po-translation-file-"
kind: "technique"
aliases: []
title: "Unpatched Godot 4 flaw lets a community .po translation file run attacker-chosen code inside exported games"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Godot Engine", "fixed": [], "versions": ">=4.1.0,<=4.7.2", "ecosystem": "other"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-27T09:05:13+00:00"
updated_at: "2026-10-27T09:05:13+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-27T09:05:13+00:00"}]
---

# Unpatched Godot 4 flaw lets a community .po translation file run attacker-chosen code inside exported games

In Godot Engine 4.1.0 through 4.7.2, the Plural-Forms header of a gettext .po translation file is not checked and is evaluated by the engine's general Expression evaluator. A crafted header can deserialize a GDScript object (via bytes_to_var_with_objects) whose script source the attacker controls. That script then runs inside the game process, with the game's privileges, the first time the game shows a pluralized string. At risk: any Godot 4 game that ships or loads community or third-party translations, and the players who install them. The researcher (Tomasz Kaye) confirmed it at runtime on the official 4.7-stable export and published a public PoC. Disclosed 2026-10-26. Still unpatched as of 2026-10-26: maintainer PRs #123130 and #123857 are not merged. A CVE has been requested. No exploitation in the wild reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:Godot Engine affected ? fixed ?

## How to check

Find Godot 4.1-4.7.2 projects that load .po files from outside the shipped build (mods, community translation packs, user folders). Inspect each .po Plural-Forms header: anything beyond n, numbers, comparison/logic/arithmetic operators and ?: (for example function calls such as bytes_to_var_with_objects) is malicious.

## Fix

Do not load untrusted .po translations in Godot 4 games until a fixed release is out. Ship translations only as vetted, signed-off assets, or validate Plural-Forms against the GNU gettext grammar before loading. Watch for PRs #123130/#123857 to land in a Godot 4.7.x release and upgrade when they do.

## Timeline

- 2026-10-27T09:05:13+00:00 analyst

## Documents

- [describes] r/netsec: A community translation can run attacker-chosen code in an exported Godot game https://www.reddit.com/r/netsec/comments/1xgn2l1/a_community_translation_can_run_attackerchosen/
- [describes] Godot 4.x: arbitrary code execution via .po translation file Plural-Forms header https://www.openwall.com/lists/oss-security/2026/10/26/19

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_