PT-2026-6481

Summary A Prototype Pollution vulnerability exists in the the npm package locutus 2.0.12. Despite a previous fix that attempted to mitigate Prototype Pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using...

PT-2026-6310

Name of the Vulnerable Software and Affected Versions Locutus versions 2.0.12 through 2.0.38 Description Locutus, designed to bring standard libraries from other programming languages to JavaScript for educational purposes, contains a prototype pollution issue. A previous attempt to address...

EUVD-2021-1253

Malware in sbrugna...

EUVD-2021-1057

Malware in sbrugna...

EUVD-2021-1473

Malware in sbrugna...

CVE-2020-13619

php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution...

@random-guys/coralpay-pgp (>=0.0.1, <=0.1.0), @woocommerce/components (>=1.0.0, <=1.0.1) +4 more potentially affected by CVE-2020-13619 via locutus (>=2.0.10, <=2.0.11)

locutus NPM version =2.0.10, =0.0.1, =1.0.0, =1.1.0, =1.0.2, =1.0.52, =0.1.0, =0.2.1 Source cves: CVE-2020-13619 Source advisory: OSV:GHSA-H86X-MV66-GR5Q...

OS Command Injection in Locutus

php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution...

GHSA-H86X-MV66-GR5Q OS Command Injection in Locutus

php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution...

@random-guys/coralpay-pgp (>=0.0.1, <=0.1.0), @woocommerce/components (>=1.0.0, <=1.0.1) +4 more potentially affected by CVE-2021-23392 via locutus (>=2.0.10, <=2.0.14)

locutus NPM version =2.0.10, =0.0.1, =1.0.0, =1.1.0, =1.0.2, =1.0.52, =0.1.0, =0.2.1 Source cves: CVE-2021-23392 Source advisory: OSV:GHSA-39Q4-P535-C852...

GHSA-39Q4-P535-C852 Uncontrolled Resource Consumption in locutus

The package locutus before 2.0.15 is vulnerable to Regular Expression Denial of Service ReDoS via the gopherparsedir function...

Uncontrolled Resource Consumption in locutus

The package locutus before 2.0.15 is vulnerable to Regular Expression Denial of Service ReDoS via the gopherparsedir function...

Regular Expression Denial Of Service (ReDoS)

locutus is vulnerable to regular expression denial of service ReDoS. An attacker is able to cause a denial of service condition via the gopherparsedir feature...

CVE-2021-23392

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service ReDoS via the gopherparsedir function...

CVE-2021-23392

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service ReDoS via the gopherparsedir function...

CVE-2021-23392

The issue affects locutus (JavaScript/Node.js package) before version 2.0.15, where the gopher_parsedir function is vulnerable to Regular Expression Denial of Service (ReDoS). The root cause is a flaw in gopher_parsedir that can be exploited to cause high CPU/denial by crafted input. The recommen...

CVE-2021-23392 Regular Expression Denial of Service (ReDoS)

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service ReDoS via the gopherparsedir function...

CVE-2021-23392

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service ReDoS via the gopherparsedir function...

locutus 安全漏洞

Locutus PHP is an open source PHP language standard library used in JavaScript. A security vulnerability exists in locutus versions prior to 2.0.15, which stems from the gopherparsedir function being susceptible to a denial of service ReDoS attack...

Prototype Pollution in locutus

Overview Versions of locutus prior to 2.0.12 are vulnerable to Prototype Pollution via the php.strings.parsestr function. Recommendation Upgrade to version 2.0.12 or later References - CVE - GitHub Advisory...