p PatchFirst

CVE-2026-33993

CVE-2026-33993 · Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filtering the `__proto__` key. When a PHP serialized payload contains `__proto__` as an array or object key, JavaScript's `__proto__` setter is invoked, replacing the deserialized object's prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override. This is distinct from the previously reported prototype pollution in `parse_str` (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) — `unserialize` is a different function with no mitigation applied. Version 3.0.25 patches the issue.

CVSS 6.9 · Media · EPSS 0,6% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • locutus

    Versiones
    • < 3.0.25: Afectada

    Sin corrección publicada

  • locutus npm

    Intervalos de versiones afectados
    • SEMVER: < 3.0.25

    Actualiza a 3.0.25

Fuentes originales

Comprueba tu servidor →