https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 10:04:30 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-337785 EUVD-2026-337785 https://cve.radiocsirt.org/vuln/euvd-2026-337785 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25521 <p>Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.</p> <p>Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-25521 https://cve.radiocsirt.org/vuln/ghsa-rxrv-835q-v5mh <p><strong>Affected:</strong> npm: locutus</p> <p>### Summary A Prototype Pollution vulnerability exists in the the npm package locutus (&gt;2.0.12). Despite a previous fix that attempted to mitigate Prototype Pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue was fixed in version 2.0.39.</p> <p>### Details The vulnerability resides in line 77 to 79 of https://github.com/locutusjs/locutus/blob/main/src/php/strings/parse_str.js where includes() function is used to check whether user provided input contain forbidden strings.</p> <p>### PoC</p> <p>#### Steps to reproduce 1. Install latest version of locutus using npm install or cloning from git 2. Run the following code snippet:</p> <p>```javascript String.prototype.includes = () =&gt; false; console.log({}.polluted); const locutus = require(&#39;locutus&#39;); locutus.php.strings.parse_str(&#39;constructor[prototype][polluted]=yes&#39;); console.log({}.polluted); // prints yes -&gt; indicating that the patch was bypassed and Prototype Pollution occurred ```</p> <p>#### Expected behavior Prototype Pollution should be prevented and {} should not gain new properties. This should be printed on the console: ``` undefined undefined OR throw an Error ```</p> <p>#### Actual behavior Object.prototype is polluted This is printed on the console: ``` undefined yes ```</p> <p>### Impact This is a Prototype Pollution vulnerability, which can have severe security implications depending on how locutus is used by downstream applica…</p> <p><strong>Affected:</strong> npm: locutus</p> <p>### Summary A Prototype Pollution vulnerability exists in the the npm package locutus (&gt;2.0.12). Despite a previous fix that attempted to mitigate Prototype Pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue was fixed in version 2.0.39.</p> <p>### Details The vulnerability resides in line 77 to 79 of https://github.com/locutusjs/locutus/blob/main/src/php/strings/parse_str.js where includes() function is used to check whether user provided input contain forbidden strings.</p> <p>### PoC</p> <p>#### Steps to reproduce 1. Install latest version of locutus using npm install or cloning from git 2. Run the following code snippet:</p> <p>```javascript String.prototype.includes = () =&gt; false; console.log({}.polluted); const locutus = require(&#39;locutus&#39;); locutus.php.strings.parse_str(&#39;constructor[prototype][polluted]=yes&#39;); console.log({}.polluted); // prints yes -&gt; indicating that the patch was bypassed and Prototype Pollution occurred ```</p> <p>#### Expected behavior Prototype Pollution should be prevented and {} should not gain new properties. This should be printed on the console: ``` undefined undefined OR throw an Error ```</p> <p>#### Actual behavior Object.prototype is polluted This is printed on the console: ``` undefined yes ```</p> <p>### Impact This is a Prototype Pollution vulnerability, which can have severe security implications depending on how locutus is used by downstream applica…</p> https://cve.radiocsirt.org/vuln/ghsa-rxrv-835q-v5mh