{"id":"EUVD-2026-16888","enisaUuid":"29e00eb6-1215-32d4-96b8-a5c200699f3f","description":"Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filtering the `__proto__` key. When a PHP serialized payload contains `__proto__` as an array or object key, JavaScript\u0027s `__proto__` setter is invoked, replacing the deserialized object\u0027s prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override. This is distinct from the previously reported prototype pollution in `parse_str` (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) — `unserialize` is a different function with no mitigation applied. Version 3.0.25 patches the issue.","datePublished":"Mar 27, 2026, 10:14:03 PM","dateUpdated":"Mar 30, 2026, 3:45:18 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/locutusjs/locutus/security/advisories/GHSA-4mph-v827-f877\nhttps://github.com/locutusjs/locutus/pull/597\nhttps://github.com/locutusjs/locutus/commit/345a6211e1e6f939f96a7090bfeff642c9fcf9e4\nhttps://github.com/locutusjs/locutus/releases/tag/v3.0.25\n","aliases":"CVE-2026-33993\nGHSA-4mph-v827-f877\n","assigner":"GitHub_M","epss":0.59,"enisaIdProduct":[{"id":"3ff72297-8e34-3c21-9b2e-86adffba76af","product":{"name":"locutus","vendor":{"name":"locutusjs"}},"product_version":"\u003c 3.0.25"}],"enisaIdVendor":[{"id":"facc71a6-c8dc-33e8-9941-8bd0f8d75c44","vendor":{"name":"locutusjs"}}],"enisaIdVulnerability":[{"id":"0c255a5f-ffad-3ef4-b056-52269d4d4ed6","vulnerability":{"id":"GHSA-4mph-v827-f877","description":"Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()","datePublished":"Mar 27, 2026, 5:57:39 PM","dateUpdated":"Mar 30, 2026, 8:14:41 PM","baseScore":0.0,"references":"https://github.com/locutusjs/locutus/security/advisories/GHSA-4mph-v827-f877\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33993\nhttps://github.com/locutusjs/locutus/pull/597\nhttps://github.com/locutusjs/locutus/commit/345a6211e1e6f939f96a7090bfeff642c9fcf9e4\nhttps://github.com/locutusjs/locutus\nhttps://github.com/locutusjs/locutus/releases/tag/v3.0.25\n","enisa_id":"EUVD-2026-16888\n","aliases":"GHSA-4mph-v827-f877\nCVE-2026-33993\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:58:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a336a3ed-943b-33e8-a215-a31b47cff3d7","vulnerability":{"id":"CVE-2026-33993","description":"Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filtering the `__proto__` key. When a PHP serialized payload contains `__proto__` as an array or object key, JavaScript\u0027s `__proto__` setter is invoked, replacing the deserialized object\u0027s prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override. This is distinct from the previously reported prototype pollution in `parse_str` (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) — `unserialize` is a different function with no mitigation applied. Version 3.0.25 patches the issue.","datePublished":"Mar 27, 2026, 10:14:03 PM","dateUpdated":"Mar 30, 2026, 3:45:18 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/locutusjs/locutus/security/advisories/GHSA-4mph-v827-f877\nhttps://github.com/locutusjs/locutus/pull/597\nhttps://github.com/locutusjs/locutus/commit/345a6211e1e6f939f96a7090bfeff642c9fcf9e4\nhttps://github.com/locutusjs/locutus/releases/tag/v3.0.25\n","enisa_id":"EUVD-2026-16888\n","assigner":"GitHub_M","epss":0.59,"dataProcessed":"Nov 1, 2026, 7:18:59 AM","vulnerabilityProduct":[{"id":"38841f9b-d70b-3ab5-b49e-4fa78165b993","product":{"name":"locutus","vendor":{"name":"locutusjs"}},"product_version":"\u003c 3.0.25"}],"vulnerabilityVendor":[{"id":"86eea2df-4225-3d18-b5a1-e0423a540e12","vendor":{"name":"locutusjs"}}]}}],"enisaIdAdvisory":[]}