Description
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| locutusjs | locutus | >= 2.0.12, < 2.0.39 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | locutus | >= 2.0.12, < 2.0.39 | 2.0.39 | GHSA-rxrv-835q-v5mh |