Skip to content
OpenAdvisories

Package · npm

locutus

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-33994

    Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521

    Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototype pollution vulnerability exists in the `parse_str` function of the npm package locutus. An attacke…

    locutusjs locutus locutus npm
  • Medium 6.9
    CVE-2026-33993

    Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()

    Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filter…

    locutusjs locutus locutus npm
  • Medium 5.3
    CVE-2021-23392

    Regular Expression Denial of Service (ReDoS)

    The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.

    locutus npm