CVE-2026-33994

Katalog CVE

CVSS 9.8 · Critical EPSS 0,76%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada locutus. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototype pollution vulnerability exists in the `parse_str` function of the npm package locutus. An attacker can pollute `Object.prototype` by overriding `RegExp.prototype.test` and then passing a crafted query string to `parse_str`, bypassing the prototype pollution guard. This vulnerability stems from an incomplete fix for CVE-2026-25521. The CVE-2026-25521 patch replaced the `String.prototype.includes()`-based guard with a `RegExp.prototype.test()`-based guard. However, `RegExp.prototype.test` is itself a writable prototype method that can be overridden, making the new guard bypassable in the same way as the original — trading one hijackable built-in for another. Version 3.0.25 contains an updated fix.

Rincian

Terbit di NVD

27 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

0,76% peluang dieksploitasi; lebih tinggi dari 53,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/locutusjs/locutus/security/advisories/GHSA-vc8f-x9pp-wf5p exploit · advisory vendor
• https://github.com/locutusjs/locutus/commit/345a6211e1e6f939f96a7090bfeff642c9fcf9e4 patch
• https://github.com/locutusjs/locutus/pull/597 issue tracking
• https://github.com/locutusjs/locutus/releases/tag/v3.0.25 release notes