CVE-2026-25521: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in locutusjs locutus
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.
AI Analysis
Technical Summary
Locutus, a JavaScript library providing standard libraries from other languages, suffers from a prototype pollution vulnerability (CWE-1321) in versions >=2.0.12 and <2.0.39. Despite an earlier fix attempting to block forbidden keys, attackers can still pollute Object.prototype through crafted inputs involving String.prototype. This vulnerability has a CVSS 4.0 score of 9.4 (critical) and was patched in version 2.0.39. The vendor advisory from Red Hat confirms the issue and the patch.
Potential Impact
Successful exploitation allows an attacker to modify the Object prototype, potentially leading to arbitrary code execution, denial of service, or other high-impact consequences due to the critical nature of prototype pollution in JavaScript environments.
Mitigation Recommendations
Upgrade locutus to version 2.0.39 or later, where this prototype pollution vulnerability is patched. No other mitigations are indicated by the vendor advisory.
CVE-2026-25521: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in locutusjs locutus
Description
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.
CVSS v4.0
Score 9.4critical
Affected software
locutusjs
locutus
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Locutus, a JavaScript library providing standard libraries from other languages, suffers from a prototype pollution vulnerability (CWE-1321) in versions >=2.0.12 and <2.0.39. Despite an earlier fix attempting to block forbidden keys, attackers can still pollute Object.prototype through crafted inputs involving String.prototype. This vulnerability has a CVSS 4.0 score of 9.4 (critical) and was patched in version 2.0.39. The vendor advisory from Red Hat confirms the issue and the patch.
Potential Impact
Successful exploitation allows an attacker to modify the Object prototype, potentially leading to arbitrary code execution, denial of service, or other high-impact consequences due to the critical nature of prototype pollution in JavaScript environments.
Mitigation Recommendations
Upgrade locutus to version 2.0.39 or later, where this prototype pollution vulnerability is patched. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-02-02T18:21:42.487Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-25521","vendor":"Red Hat"}]
Threat ID: 6983ba62f9fa50a62fae1db6
Added to database: 02/04/2026, 21:30:10 UTC
Last enriched: 07/15/2026, 08:10:07 UTC
Last updated: 09/10/2026, 22:14:37 UTC
Views: 229
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.