Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-25521 Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerab… https://www.cve.org/CVERecord?id=CVE-2026-25521
Post summary
The text reports a prototype pollution vulnerability in Locutus versions 2.0.12–2.0.38, providing basic technical details but no PoC, exploit, or mitigation information.
🚨 CVE-2026-25521: Locutus is vulnerable to Prototy... Locutus's incomplete validation allows String.prototype bypass for object pollution, enabling property injection despit... https://zerodaysignal.com/vulnerability/CVE-2026-25521 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces a Locutus prototype‑pollution flaw (CVE‑2026‑25521) that permits property injection via String.prototype bypass, without detailing a PoC, exploit, or patch.
Locutus is vulnerable to Prototype Pollution (CVE-2026-25521). Malicious property injection can lead to further compromise. Upgrade to 2.0.39. #locutus #PrototypePollution #infosec https://www.pulsepatch.io/posts/cve-2026-25521-locutus-prototype-pollution
Post summary
Locutus is vulnerable to prototype pollution (CVE‑2026‑25521), allowing malicious property injection that can lead to further compromise; users are advised to upgrade to version 2.0.39.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | locutus | locutus | - | node.js | - |