CVE-2026-25521
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.
Vendor
Product
CWE
Yayın Tarihi
2026-02-04 22:15:59
Güncelleme
2026-02-20 21:20:40
Source Identifier
security-advisories@github.com
KEV Date Added
-