Skip to content
OpenAdvisories

Vendor

locutusjs

5 known vulnerabilities.

Products

locutus 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-32304

    Locutus: RCE via unsanitized input in create_function()

    Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary co…

    locutusjs locutus locutus npm
  • Critical 9.4
    CVE-2026-25521

    Locutus is vulnerable to Prototype Pollution

    Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollutio…

    locutusjs locutus locutus npm