{"schema":"threatline.record/2","record":{"id":"CVE-2026-25521","aliases":["GHSA-rxrv-835q-v5mh"],"summary":"locutus is vulnerable to Prototype Pollution","details":"### Summary\nA Prototype Pollution vulnerability exists in the the npm package locutus (>2.0.12). Despite a previous fix that attempted to mitigate Prototype Pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue was fixed in version 2.0.39.\n\n### Details\nThe vulnerability resides in line 77 to 79 of https://github.com/locutusjs/locutus/blob/main/src/php/strings/parse_str.js where includes() function is used to check whether user provided input contain forbidden strings.\n\n### PoC\n\n#### Steps to reproduce\n1. Install latest version of locutus using npm install or cloning from git\n2. Run the following code snippet:\n\n```javascript\nString.prototype.includes = () => false;      \nconsole.log({}.polluted);\nconst locutus = require('locutus');\nlocutus.php.strings.parse_str('constructor[prototype][polluted]=yes');\nconsole.log({}.polluted);  // prints yes -> indicating that the patch was bypassed and Prototype Pollution occurred\n```\n\n#### Expected behavior\nPrototype Pollution should be prevented and {} should not gain new properties.\nThis should be printed on the console:\n```\nundefined\nundefined OR throw an Error\n```\n\n#### Actual behavior\nObject.prototype is polluted\nThis is printed on the console:\n```\nundefined \nyes\n```\n\n### Impact\nThis is a Prototype Pollution vulnerability, which can have severe security implications depending on how locutus is used by downstream applications. Any application that processes attacker-controlled input using this `locutus.php.strings.parse_str` may be affected. It could potentially lead to the following problems:\n1. Authentication bypass\n2. Denial of service\n3. Remote code execution (if polluted property is passed to sinks like eval or child_process)","categories":["Libraries & packages"],"product":"locutus","vendor":"locutusjs","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-rxrv-835q-v5mh","source_modified_at":"2026-10-05T15:34:19Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"locutus"},"range":">= 2.0.12, < 2.0.39"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-25521","source_modified_at":"2026-07-15T02:49:16.910Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"locutus","vendor":"locutusjs","versions":[{"version":">= 2.0.12, < 2.0.39","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-rxrv-835q-v5mh","source_modified_at":"2026-10-05T15:45:04.416035427Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"locutus","purl":"pkg:npm/locutus"},"ranges":[{"events":[{"introduced":"2.0.12"},{"fixed":"2.0.39"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-rxrv-835q-v5mh","source_modified_at":"2026-10-05T15:34:19Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"locutus"},"version":"2.0.39"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-rxrv-835q-v5mh","source_modified_at":"2026-10-05T15:45:04.416035427Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"locutus","purl":"pkg:npm/locutus"},"version":"2.0.39"}],"cvss":9.4,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00498,"percentile":0.41788,"score_date":"2026-10-23"},"published_at":"2026-02-04T21:20:32.643Z","modified_at":"2026-10-05T15:45:04.416035427Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-rxrv-835q-v5mh","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-05T15:34:19Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-25521","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-07-15T02:49:16.910Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-rxrv-835q-v5mh","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-05T15:45:04.416035427Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25521","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c","tags":["x_refsource_MISC"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25521","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://access.redhat.com/security/cve/CVE-2026-25521","tags":["vdb-entry","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436950","tags":["issue-tracking","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25521.json","tags":["x_sadp-csaf-vex"]},{"url":"https://github.com/advisories/GHSA-rxrv-835q-v5mh","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-02-05T14:23:07.184247Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-05T15:45:04.416035427Z","content_hash":"3abbf391cfeb59ed32fb0a6a01752b05cf4e92e945d3eafb622a45428dc9b370"}}