p PatchFirst

CVE-2026-25521

CVE-2026-25521 · Locutus is vulnerable to Prototype Pollution

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.

CVSS 9.4 · Critical · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • locutus

    Versions
    • >= 2.0.12, < 2.0.39: Affected

    No fix published

  • locutus npm

    Affected ranges
    • SEMVER: ≥ 2.0.12, < 2.0.39

    Update to 2.0.39

Original sources

Check your server →