Locutus is a JavaScript library that ports standard libraries from other languages for educational use. In versions before 3.0.25, the unserialize() function in locutus/php/var/unserialize improperly handles deserialized data by assigning keys directly to objects without filtering the __proto__ key. When a PHP serialized payload includes __proto__ as a key, JavaScript's __proto__ setter is triggered, replacing the object's prototype with attacker-controlled content. This prototype pollution enables property injection, for...in enumeration of injected properties, and denial of service through overriding built-in methods. This vulnerability is separate from previously disclosed prototype pollution issues in locutus's parse_str function. The vulnerability is addressed in locutus version 3.0.25.

An attacker can supply a specially crafted PHP serialized payload to the unserialize() function, causing prototype pollution in the resulting JavaScript object. This can lead to injection of arbitrary properties, enumeration of these properties in loops, and denial of service by overriding built-in object methods. The vulnerability does not require privileges or user interaction and can be exploited remotely if the unserialize function processes attacker-controlled input. The CVSS 4.0 base score is 6.9, indicating a medium severity impact.

Upgrade locutus to version 3.0.25 or later, where the unserialize() function properly filters the __proto__ key to prevent prototype pollution. No other mitigations are indicated or required once the patch is applied. Patch status is confirmed by the vendor's versioning information.