#godot

Godot 4.x runs attacker GDScript from crafted .po translations

Unvalidated Plural-Forms headers reach the engine Expression evaluator, so community gettext files can execute code inside exported games.