Skip to content
OpenAdvisories

Vendor

locutusjs

5 known vulnerabilities.

Products

locutus 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-33994

    Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521

    Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototype pollution vulnerability exists in the `parse_str` function of the npm package locutus. An attacke…

    locutusjs locutus locutus npm
  • Medium 6.9
    CVE-2026-33993

    Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()

    Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filter…

    locutusjs locutus locutus npm