CVE-2026-33994

A flaw was found in the locutus npm package. A prototype pollution vulnerability exists in the parsestr function. A remote attacker can exploit this by crafting a malicious query string and overriding RegExp.prototype.test, leading to the pollution of Object.prototype. This bypasses existing...

Prototype Pollution

Overview locutus is a Locutus other languages' stadard libraries to JavaScript for fun and educational purposes Affected versions of this package are vulnerable to Prototype Pollution in the unserialize function. An attacker can inject arbitrary properties into the prototype of deserialized...

GHSA-RXRV-835Q-V5MH locutus is vulnerable to Prototype Pollution

Summary A Prototype Pollution vulnerability exists in the the npm package locutus 2.0.12. Despite a previous fix that attempted to mitigate Prototype Pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using...

Prototype Pollution

Overview locutus is a Locutus other languages' stadard libraries to JavaScript for fun and educational purposes Affected versions of this package are vulnerable to Prototype Pollution via the locutus.php.strings.parsestr function. An attacker can modify the prototype of global objects by supplyin...

GHSA-F98M-Q3HR-P5WQ Prototype Pollution in locutus

All versions of package locutus prior to version 2.0.12 are vulnerable to Prototype Pollution via the php.strings.parsestr function...

CVE-2020-7719

Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parsestr function...

Code injection

Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parsestr function...

CVE-2020-7719 Prototype Pollution

Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parsestr function...

Prototype Pollution

Overview locutus is a Locutus other languages' stadard libraries to JavaScript for fun and educational purposes Affected versions of this package are vulnerable to Prototype Pollution via the php.strings.parsestr function. POC: const locutus = require'locutus';...