CVE-2026-25521
High · 8.8CVSS
8.8
EPSS
0.5%
Published
Feb 4, 2026
CISA due date
—
The record
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | locutus | 2.0.12 | 2.0.39 |
Related vulnerabilities
- GHSA-rxrv-835q-v5mh locutus is vulnerable to Prototype Pollution Same vulnerability
- CVE-2026-33994 Locutus brings stdlibs of other programming languages to JavaScript for educational… Also affects locutus
- CVE-2026-33993 Locutus brings stdlibs of other programming languages to JavaScript for educational… Also affects locutus
- GHSA-vc8f-x9pp-wf5p Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521 Also affects locutus
- GHSA-4mph-v827-f877 Locutus has Prototype Pollution via __proto__ Key Injection in unserialize() Also affects locutus
- CVE-2026-32304 Locutus brings stdlibs of other programming languages to JavaScript for educational… Also affects locutus
- GHSA-vh9h-29pq-r5m8 Locutus vulnerable to RCE via unsanitized input in create_function() Also affects locutus
- CVE-2026-29091 Locutus brings stdlibs of other programming languages to JavaScript for educational… Also affects locutus