CVE-2026-33993

A flaw was found in Locutus, a library that integrates standard libraries from other programming languages into JavaScript. The unserialize function, which converts serialized PHP data into JavaScript objects, fails to filter the proto key during deserialization. A remote attacker can exploit thi...

Locutus 安全漏洞

Locutus is an open-source JavaScript library developed by Locutus. Versions of Locutus prior to 3.0.25 contained security vulnerabilities. These vulnerabilities stemmed from the unserialize function not filtering the proto key, which could lead to prototype pollution, property injection, and...

Locutus 安全漏洞

Locutus is an open-source JavaScript library developed by Locutus. Versions of Locutus from 2.0.39 to 3.0.25 contained security vulnerabilities. These vulnerabilities stemmed from a bypassable prototype pollution protection mechanism in the parsestr function, which could lead to prototype polluti...

CVE-2026-32304

A flaw was found in Locutus, a JavaScript library that provides standard library functions. The createfunction function in Locutus passes user-supplied arguments and code directly to the JavaScript Function constructor without proper sanitization. This vulnerability allows a remote attacker to...

Locutus 代码注入漏洞

Locutus is an open-source JavaScript library developed by Locutus. Versions of Locutus prior to 3.0.14 contained a code injection vulnerability. This vulnerability stemmed from the createfunction function not properly cleaning parameters, which could allow arbitrary code to execute...

Locutus 安全漏洞

Locutus is an open-source JavaScript library developed by Locutus. Versions of Locutus prior to 3.0.0 contained security vulnerabilities, which stemmed from insecure implementations of the calluserfuncarray function, potentially allowing remote code execution...

Locutus 安全漏洞

Locutus is an open-source JavaScript library developed by Locutus. Versions of Locutus from 2.0.12 to 2.0.39 contained security vulnerabilities. These vulnerabilities were due to insufficient input validation, which could lead to prototype pollution...

GHSA-H86X-MV66-GR5Q OS Command Injection in Locutus

php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution...