Skip to content
OpenAdvisories

Package · npm

locutus

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Medium 6.3
    CVE-2026-33994

    Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521

    Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototype pollution vulnerability exists in the `parse_str` function of the npm package locutus. An attacke…

    locutusjs locutus locutus npm
  • Medium 6.9
    CVE-2026-33993

    Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()

    Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filter…

    locutusjs locutus locutus npm
  • Critical 9.8
    CVE-2026-32304

    Locutus: RCE via unsanitized input in create_function()

    Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary co…

    locutusjs locutus locutus npm
  • High 8.1
    CVE-2026-29091

    Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection

    Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementatio…

    locutusjs locutus locutus npm
  • Critical 9.4
    CVE-2026-25521

    Locutus is vulnerable to Prototype Pollution

    Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollutio…

    locutusjs locutus locutus npm
  • Medium 5.3
    CVE-2021-23392

    Regular Expression Denial of Service (ReDoS)

    The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.

    locutus npm
  • Critical 9.8
    CVE-2020-7719

    Prototype Pollution

    Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.

    locutus npm
  • Critical 9.8
    CVE-2020-13619

    OS Command Injection in Locutus

    php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.

    locutus npm