PT-2026-6310 · Locutus · Locutus

Cristianstaicu + 3 · Published 2026-02-02 · Updated 2026-02-04 · CVE-2026-25521

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Locutus versions 2.0.12 through 2.0.38

Description Locutus, designed to bring standard libraries from other programming languages to JavaScript for educational purposes, contains a prototype pollution issue. A previous attempt to address prototype pollution by checking for forbidden keys in user input was insufficient. It remains possible to pollute Object.prototype through a crafted input utilizing String.prototype. This allows for malicious property injection, potentially leading to further compromise.

Recommendations Upgrade to version 2.0.39.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-25521

GHSA-RXRV-835Q-V5MH

Affected Products

Locutus

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25521.json · Exploit
• https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh · Vendor Advisory
• https://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25521 · Security Note
• https://osv.dev/vulnerability/GHSA-rxrv-835q-v5mh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25521 · Vendor Advisory
• https://github.com/locutusjs/locutus · Note
• https://twitter.com/pulsepatchio/status/2019064048990740650 · Twitter Post
• https://twitter.com/CVEnew/status/2019182755393990935 · Twitter Post
• https://twitter.com/0dayPublishing/status/2019160675965174207 · Twitter Post