VULNERABILITY INTELLIGENCE
CVE-2026-25521
CVSS score8.8 HIGH
EPSS probability0.31%
CISA KEVNot currently listed
Published2026-02-04
Last modified2026-07-15
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Description
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.
Weakness classification
- security-advisories@github.com: CWE-1321
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-915