Locutus
CVE-2026-25521
CRITICAL
GHSA-rxrv-835q-v5mh
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Input is typically remote data (AV:N) but reliable exploitation depends on a tampered prototype or downstream gadget (AC:H); pollution mainly corrupts integrity (I:H) with lesser confidentiality/availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
10DescriptionCVE.org
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.
AnalysisAI
Prototype pollution in the Locutus JavaScript library (npm package, versions >= 2.0.12 and < 2.0.39) lets attacker-influenced input passed to the php.strings.parse_str function pollute Object.prototype, bypassing a prior guard. The earlier fix rejected forbidden keys using String.prototype.includes(), but an attacker able to override that method - or supply crafted keys such as constructor[prototype][polluted]=yes - defeats the check; publicly available exploit code exists in the GHSA advisory. EPSS exploitation probability is very low (0.01%, 1st percentile), it is not on CISA KEV, and no public exploit is identified as active in the wild.
Technical ContextAI
Locutus reimplements standard libraries from other languages (notably PHP) in JavaScript for educational use. The flaw is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes, i.e. prototype pollution) in src/php/strings/parse_str.js, the PHP parse_str() port that parses query-string-style input into a target object. The prior mitigation checked each parsed key with key.includes('__proto__'|'constructor'|'prototype'); because that guard depends on the runtime's mutable String.prototype.includes method, an attacker who can replace it with a function returning false (or otherwise evade the substring check) causes nested assignments like constructor[prototype][polluted] to write onto Object.prototype, affecting every object in the process. The CPE cpe:2.3:a:locutus:locutus:*:*:*:*:*:node.js:*:* confirms the affected target is the Node.js distribution of the package. The patch replaces the includes()-based check with a regex test (/__proto__|constructor|prototype/.test(key)), which does not depend on mutable string-prototype methods.
RemediationAI
Upgrade to Locutus 2.0.39 or later, which replaces the String.prototype.includes-based key guard with a regex test that cannot be bypassed by tampering with string-prototype methods (Vendor-released patch: 2.0.39; commit 042af9ca7fde2ff599120783e720a17f335bb01c). Until you can upgrade, avoid passing attacker-controlled input directly into locutus.php.strings.parse_str, and validate or reject keys containing __proto__, constructor, or prototype before parsing; as a structural defense, call Object.freeze(Object.prototype) at process start (trade-off: this breaks libraries that legitimately extend built-in prototypes) or parse into a null-prototype target object where feasible. Review the GHSA advisory (https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh) and the commit diff for exact behavior, and audit downstream sinks such as eval or child_process where a polluted property could be leveraged.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today