CVE-2026-33994
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes.
Published Mar 27, 2026 · updated Jun 17, 2026 · locutus locutus
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototype pollution vulnerability exists in the function of the npm package locutus. An attacker can pollute by overriding and then passing a crafted query string to , bypassing the prototype pollution guard. This vulnerability stems from an incomplete fix for CVE-2026-25521. The CVE-2026-25521 patch replaced the -based guard with a -based guard. However, is itself a writable prototype method that can be overridden, making the new guard bypassable in the same way as the original — trading one hijackable built-in for another. Version 3.0.25 contains an updated fix.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 27, 2026 · NIST NVD
Detected
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototype pollution vulnerability exists in the function of the npm package locutus. An attacker can pollute by overriding and then passing a crafted query string to , bypassing the prototype pollution guard. This vulnerability stems from an incomp
Jun 17, 2026 · NIST NVD
Updated
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototype pollution vulnerability exists in the function of the npm package locutus. An attacker can pollute by overriding and then passing a crafted query string to , bypassing the prototype pollution guard. This vulnerability stems from an incomp
Affected
- cpe locutus/locutusversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33994
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33994
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototype pollution vulnerability exists in the function of the npm package locutus. An attacker can pollute `Object
nvd.nist.gov