PT-2026-28587 · Locutus · Locutus
Offset
·
Published
2026-03-27
·
Updated
2026-03-28
·
CVE-2026-33993
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Locutus versions prior to 3.0.25
Description
The
unserialize() function in locutus/php/var/unserialize assigns deserialized keys to plain objects via bracket notation without filtering the proto key. When a PHP serialized payload contains proto as an array or object key, JavaScript's proto setter is invoked, replacing the deserialized object's prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override. The vulnerable code resides in the expectArrayItems() function at line 358 and the expectObject() function at line 278 within src/php/var/unserialize.ts. Specifically, these functions create a plain object and assign user-controlled keys without filtering for the proto key. This allows an attacker to inject properties, propagate them through for...in loops, and potentially cause a denial of service by overriding built-in methods. The issue is not a global Object.prototype pollution, but rather affects only the deserialized object's prototype. The vulnerability is distinct from a previously reported prototype pollution in parse str.Recommendations
Versions prior to 3.0.25 should be updated to version 3.0.25 or later. As a mitigation, filter dangerous keys before assignment in both
expectArrayItems and expectObject. Alternatively, create objects with a null prototype to prevent proto setter invocation entirely.Exploit
Fix
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Locutus