CVE-2026-25521criticalCWE-1321CWE-915

CVE-2026-25521: falha crítica em locutusjs locutus

Locutus is vulnerable to Prototype Pollution

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar locutus+ Monitorar locutus

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.4epss 0.3%
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
locutusjs · locutus
CVEs relacionadas — locutusjs locutus

No mesmo produto, das mais perigosas para as menos.

CVE-2026-29091HIGHLocutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code InjectionEPSS 0.9%CVE-2026-33993MEDIUMLocutus has Prototype Pollution via __proto__ Key Injection in unserialize()EPSS 0.6%CVE-2026-32304CRITICALLocutus: RCE via unsanitized input in create_function()EPSS 0.6%CVE-2026-33994MEDIUMLocutus Prototype Pollution due to incomplete fix for CVE-2026-25521EPSS 0.6%