CVE-2026-25521

HIGH

locutus 2.0.12-2.0.38 - Prototype Pollution via String.prototype

Title source: llm
STIX 2.1

Description

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.

References (5)

Core 5

Scores

CVSS v3 8.8
EPSS 0.0026
EPSS Percentile 17.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-1321 CWE-915
Status published
Products (3)
locutus/locutus 2.0.12 - 2.0.39
locutusjs/locutus >= 2.0.12, < 2.0.39
npm/locutus 2.0.12 - 2.0.39npm
Published Feb 04, 2026
Tracked Since Feb 18, 2026