Home

Description

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.

PUBLISHED Reserved 2026-02-02 | Published 2026-02-04 | Updated 2026-07-15 | Assigner GitHub_M




CRITICAL: 9.4CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Problem types

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Product status

>= 2.0.12, < 2.0.39
affected

References

access.redhat.com/security/cve/CVE-2026-25521 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2436950 (RHBZ#2436950) issue-tracking

security.access.redhat.com/...2/vex/2026/cve-2026-25521.json

github.com/...ocutus/security/advisories/GHSA-rxrv-835q-v5mh

github.com/...ommit/042af9ca7fde2ff599120783e720a17f335bb01c

cve.org (CVE-2026-25521)

nvd.nist.gov (CVE-2026-25521)

Download JSON