CVE-2026-33993

Katalog CVE

CVSS 9.8 · Critical EPSS 0,75%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada locutus. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filtering the `__proto__` key. When a PHP serialized payload contains `__proto__` as an array or object key, JavaScript's `__proto__` setter is invoked, replacing the deserialized object's prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override. This is distinct from the previously reported prototype pollution in `parse_str` (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) — `unserialize` is a different function with no mitigation applied. Version 3.0.25 patches the issue.

Rincian

Terbit di NVD

27 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

0,75% peluang dieksploitasi; lebih tinggi dari 53,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/locutusjs/locutus/security/advisories/GHSA-4mph-v827-f877 exploit · mitigasi · advisory vendor
• https://github.com/locutusjs/locutus/commit/345a6211e1e6f939f96a7090bfeff642c9fcf9e4 patch
• https://github.com/locutusjs/locutus/pull/597 issue tracking
• https://github.com/locutusjs/locutus/releases/tag/v3.0.25 release notes