Godot 4.x runs attacker GDScript from crafted .po translations

Godot Engine 4.1 through 4.7.2 will execute attacker-chosen GDScript when an exported game loads a malicious gettext .po translation and later displays a pluralized string, security researcher Tomasz Kaye disclosed on 26 October 2026.

The .po loader accepts the file's Plural-Forms header without checking it against the GNU gettext grammar. On the first plural lookup the engine evaluates that header with its general Expression facility, which can invoke registered utility functions. A crafted header can deserialize an object whose script source is attacker-controlled; Godot then compiles the script and runs its static initializer in the game process, under the game's own privileges.

The practical risk is any Godot 4 title that ships or accepts community translation packs. An untrusted .po alone is enough: no separate binary payload is required. Kaye demonstrated both Expression-level side effects and full GDScript static-initializer execution on a stock 4.7 stable export, succeeding on every trial run. No equivalent path was found in Godot 3.5.

As of the disclosure date the flaw remained unpatched in master and in the 4.7.x line. Maintainers have proposed narrowing which functions the Plural-Forms evaluator may call, but those changes had not merged. A CVE assignment was requested from MITRE after publication.