Vulnerability details
CVE-2026-25521
locutusjs locutus
Locutus is vulnerable to Prototype Pollution
CVSS 4.0
9.4Critical
Official description
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.4Critical | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| 9.3Critical | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| locutusjs | locutus | >= 2.0.12, < 2.0.39 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh x_refsource_CONFIRM
- https://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-25521 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2436950 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25521.json x_sadp-csaf-vex
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-02-05
- Last updated
- 2026-07-15
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.31%
Probability of exploitation in 30 days
24.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes