CVE-2026-25521

CRITICAL EPSS 17.4%
Published Feb 4, 20264mo ago · Modified Jun 17, 20261w ago
9.4 CVSS 4.0
Critical
Find Similar
Published Feb 4, 2026 4mo ago
Last Modified Jun 17, 2026 1w ago

Description

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.

CVSS Details

Base Score
9.4
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
17.4% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-1321

Affected Products 1

VendorProductVersionRange
locutuslocutus*≥2.0.12  –  <2.0.39

References 2

  • github.com https://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c
    Patch
  • github.com https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c
    Patch