A community translation can run attacker-chosen code in an exported Godot game | axeghost | Axe Ghost. On Steam! | Offprint
axeghost.offprint.app
A .po translation file is meant to be data. In Godot 4.1 and later, part of it is executed as code (the chain is present in the engine source from 4.1; I confirmed it at runtime on 4.7). A player...