CVE-2026-25521
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A prototype pollution vulnerability has been discovered in the Locutus library (versions 2.0.12 through 2.0.38). Despite a previous fix that checked for forbidden keys, an attacker can still pollute Object.prototype via crafted input using String.prototype.
Risk Assessment
The risk involves the ability to modify the global JavaScript object prototype, potentially leading to unexpected application behavior, privilege escalation, or arbitrary code execution in browser or server contexts.
Recommendation
Immediately update the Locutus library to version 2.0.39 or later, which contains the fix for this vulnerability.
Other vulnerabilities in Locutus
See all- CVE-2026-32304Critical
In the Locutus library prior to version 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary JavaScript code execution. This vulnerability affects the v3.x branch and is distinct from CVE-2026-29091.
- CVE-2026-29091High
A remote code execution (RCE) vulnerability was discovered in the Locutus project, which ports standard libraries from other programming languages to JavaScript. The flaw affects the call_user_func_array function and its wrapper call_user_func, which fail to properly validate callback array components before passing them to eval().
Original NVD description (English source)
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.