{"id":"EUVD-2026-5340","enisaUuid":"874ff14a-e461-3980-aad1-06f79c37cc61","description":"Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.","datePublished":"Feb 4, 2026, 9:20:32 PM","dateUpdated":"Jul 15, 2026, 2:49:16 AM","baseScore":9.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh\nhttps://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c\n","aliases":"CVE-2026-25521\nGHSA-rxrv-835q-v5mh\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"4f2326b4-c621-37ea-a0d0-ea5065e4258b","product":{"name":"locutus","vendor":{"name":"locutusjs"}},"product_version":"2.0.12, \u003c 2.0.39"}],"enisaIdVendor":[{"id":"c46b5c57-b0bd-3adb-84f6-c1092d00b947","vendor":{"name":"locutusjs"}}],"enisaIdVulnerability":[{"id":"1b66b2a7-4357-373e-972a-74555859cda1","vulnerability":{"id":"GHSA-rxrv-835q-v5mh","description":"locutus is vulnerable to Prototype Pollution","datePublished":"Feb 2, 2026, 10:21:54 PM","dateUpdated":"Oct 5, 2026, 3:34:16 PM","baseScore":0.0,"references":"https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-25521\nhttps://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c\nhttps://access.redhat.com/security/cve/CVE-2026-25521\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2436950\nhttps://github.com/locutusjs/locutus\nhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25521.json\n","enisa_id":"EUVD-2026-5340\n","aliases":"CVE-2026-25521\nGHSA-rxrv-835q-v5mh\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:53:13 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f40b9e82-ce35-3aa9-8f47-6207dc86d1a8","vulnerability":{"id":"CVE-2026-25521","description":"Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.","datePublished":"Feb 4, 2026, 9:20:32 PM","dateUpdated":"Jul 15, 2026, 2:49:16 AM","status":"PUBLISHED","baseScore":9.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh\nhttps://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c\n","enisa_id":"EUVD-2026-5340\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Oct 27, 2026, 7:13:18 AM","vulnerabilityProduct":[{"id":"7d60cbe0-2392-39ad-ad89-7ca80b0c34d6","product":{"name":"locutus","vendor":{"name":"locutusjs"}},"product_version":"2.0.12, \u003c 2.0.39"}],"vulnerabilityVendor":[{"id":"111074cd-48ba-3c12-832a-a6498d0ff2c0","vendor":{"name":"locutusjs"}}]}}],"enisaIdAdvisory":[]}