Locutus is vulnerable to Prototype Pollution

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.

Problem type

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Affected products

locutusjs

locutus

>= 2.0.12, < 2.0.39 - AFFECTED

References

https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh

https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh

x_refsource_CONFIRM

https://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c

https://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c

x_refsource_MISC

GitHub Security Advisories

GHSA-rxrv-835q-v5mh

locutus is vulnerable to Prototype Pollution

https://github.com/advisories/GHSA-rxrv-835q-v5mh

Summary

A Prototype Pollution vulnerability exists in the the npm package locutus (>2.0.12). Despite a previous fix that attempted to mitigate Prototype Pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue was fixed in version 2.0.39.

Details

The vulnerability resides in line 77 to 79 of https://github.com/locutusjs/locutus/blob/main/src/php/strings/parse_str.js where includes() function is used to check whether user provided input contain forbidden strings.

PoC

Steps to reproduce

Install latest version of locutus using npm install or cloning from git
Run the following code snippet:

String.prototype.includes = () => false;      
console.log({}.polluted);
const locutus = require('locutus');
locutus.php.strings.parse_str('constructor[prototype][polluted]=yes');
console.log({}.polluted);  // prints yes -> indicating that the patch was bypassed and Prototype Pollution occurred

Expected behavior

Prototype Pollution should be prevented and {} should not gain new properties. This should be printed on the console:

undefined
undefined OR throw an Error

Actual behavior

Object.prototype is polluted This is printed on the console:

undefined 
yes

Impact

This is a Prototype Pollution vulnerability, which can have severe security implications depending on how locutus is used by downstream applications. Any application that processes attacker-controlled input using this locutus.php.strings.parse_str may be affected. It could potentially lead to the following problems:

Authentication bypass
Denial of service
Remote code execution (if polluted property is passed to sinks like eval or child_process)

github.com

https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh

github.com

https://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c

github.com

https://github.com/advisories/GHSA-rxrv-835q-v5mh

JSON source

https://cveawg.mitre.org/api/cve/CVE-2026-25521

Click to expand

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-25521",
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "dateUpdated": "2026-02-04T21:20:32.643Z",
    "dateReserved": "2026-02-02T18:21:42.487Z",
    "datePublished": "2026-02-04T21:20:32.643Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M",
        "dateUpdated": "2026-02-04T21:20:32.643Z"
      },
      "title": "Locutus is vulnerable to Prototype Pollution",
      "descriptions": [
        {
          "lang": "en",
          "value": "Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39."
        }
      ],
      "affected": [
        {
          "vendor": "locutusjs",
          "product": "locutus",
          "versions": [
            {
              "version": ">= 2.0.12, < 2.0.39",
              "status": "affected"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')",
              "cweId": "CWE-1321",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh",
          "name": "https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh",
          "tags": [
            "x_refsource_CONFIRM"
          ]
        },
        {
          "url": "https://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c",
          "name": "https://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c",
          "tags": [
            "x_refsource_MISC"
          ]
        }
      ],
      "metrics": [
        {}
      ]
    }
  }
}