Read the docs

locutusjs

Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

locutusjs records in CISA KEV

No locutusjs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Locutus 7 records HIGH Locutus Php 1 record MEDIUM

Records

8 records

TI-2026-24833 CVE-2026-32304 · GHSA-vh9h-29pq-r5m8

Locutus: RCE via unsanitized input in create_function()

Priority HIGH 82

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00647 Published 2026-03-12 Partial fix · 3.0.14 CWE-94
TI-2020-06239 CVE-2020-7719 · GHSA-f98m-q3hr-p5wq

Prototype pollution in locutus

Priority MEDIUM 47

Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02753 Published 2020-09-01 Fixed in 2.0.12 CWE-1321
TI-2026-20630 CVE-2026-25521 · GHSA-rxrv-835q-v5mh

Locutus is vulnerable to Prototype Pollution

Priority MEDIUM 42

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes.

CVSS 4.0CRITICAL 9.4 Local No auth No interaction EPSS 0.00314 Published 2026-02-04 Fixed in 2.0.39 CWE-1321
TI-2021-06085 CVE-2021-23392 · GHSA-39q4-p535-c852

Regular expression denial of service (ReDoS) in locutus

Priority LOW 37

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01936 Published 2021-06-08 Fixed in 2.0.15 CWE-400
Open these records in search →