PT-2026-6310 · Locutus · Locutus

Cristianstaicu + 3 · Publicado 2026-02-02 · Atualizado 2026-02-04 · CVE-2026-25521

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Crítica

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Locutus versions 2.0.12 through 2.0.38

Description Locutus, designed to bring standard libraries from other programming languages to JavaScript for educational purposes, contains a prototype pollution issue. A previous attempt to address prototype pollution by checking for forbidden keys in user input was insufficient. It remains possible to pollute Object.prototype through a crafted input utilizing String.prototype. This allows for malicious property injection, potentially leading to further compromise.

Recommendations Upgrade to version 2.0.39.

Exploit

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

CVE-2026-25521

GHSA-RXRV-835Q-V5MH

Produtos afetados

Locutus

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25521.json · Exploit
• https://github.com/locutusjs/locutus · Nota
• https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh · Aviso do Fabricante
• https://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c · Correção
• https://twitter.com/pulsepatchio/status/2019064048990740650 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25521 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-rxrv-835q-v5mh · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2019182755393990935 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-25521 · Aviso do Fabricante
• https://twitter.com/0dayPublishing/status/2019160675965174207 · Publicação no Twitter