Locutus is a JavaScript package that ports standard libraries from other languages. Versions >= 2.0.39 and < 3.0.25 have a prototype pollution vulnerability in the parse_str function. The vulnerability arises because the guard against prototype pollution was changed from using String.prototype.includes() to RegExp.prototype.test(), but RegExp.prototype.test is itself writable and can be overridden by an attacker. This allows an attacker to bypass the guard by overriding RegExp.prototype.test and then passing a crafted query string to parse_str, resulting in pollution of Object.prototype. This vulnerability is a regression from an incomplete fix for CVE-2026-25521. The issue is fixed in version 3.0.25 with an updated patch.

Successful exploitation allows an attacker to modify Object.prototype, which can lead to unexpected behavior in applications using the vulnerable locutus versions. This can cause security issues such as privilege escalation or denial of service depending on how the polluted prototype is used. The vulnerability does not require user interaction and can be exploited remotely over the network. The CVSS score of 6.3 reflects a medium severity impact with low attack complexity and no privileges required.

Upgrade locutus to version 3.0.25 or later, where the vulnerability is fixed with an updated guard against prototype pollution. There is no indication that temporary workarounds or other mitigations are effective. Patch status is confirmed by the versioning information in the advisory. Users should verify they are not using affected versions and update accordingly.