Skip to content
OpenAdvisories

Package · npm

locutus

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-32304

    Locutus: RCE via unsanitized input in create_function()

    Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary co…

    locutusjs locutus locutus npm
  • Critical 9.4
    CVE-2026-25521

    Locutus is vulnerable to Prototype Pollution

    Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollutio…

    locutusjs locutus locutus npm
  • Critical 9.8
    CVE-2020-7719

    Prototype Pollution

    Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.

    locutus npm
  • Critical 9.8
    CVE-2020-13619

    OS Command Injection in Locutus

    php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.

    locutus npm