CVE-2026-25521
CVE-2026-25521 · Locutus is vulnerable to Prototype Pollution
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.
CVSS 9.4 · Crítica · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
Fuentes originales
- https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh
- https://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c
- https://access.redhat.com/security/cve/CVE-2026-25521
- https://bugzilla.redhat.com/show_bug.cgi?id=2436950
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25521.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-25521