CVE-2026-25521criticalCWE-1321CWE-915

CVE-2026-25521: fallo crítico en locutusjs locutus

Locutus is vulnerable to Prototype Pollution

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear locutus+ Monitorear locutus

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.4epss 0.3%
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Productos afectados
locutusjs · locutus
CVEs relacionadas — locutusjs locutus

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-29091HIGHLocutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code InjectionEPSS 0.9%CVE-2026-33993MEDIUMLocutus has Prototype Pollution via __proto__ Key Injection in unserialize()EPSS 0.6%CVE-2026-32304CRITICALLocutus: RCE via unsanitized input in create_function()EPSS 0.6%CVE-2026-33994MEDIUMLocutus Prototype Pollution due to incomplete fix for CVE-2026-25521EPSS 0.6%