Read the docs
TI-2026-26333 Aliases CVE-2026-33993GHSA-4mph-v827-f877

Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()

Priority HIGH 70CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filtering the `__proto__` key. When a PHP serialized payload contains `__proto__` as an array or object key, JavaScript's `__proto__` setter is invoked, replacing the deserialized object's prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override. This is distinct from the previously reported prototype pollution in `parse_str` (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) — `unserialize` is a different function with no mitigation applied. Version 3.0.25 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00592 48th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial locutus (locutusjs): 3.0.25locutus (npm): 3.0.25Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
locutusjslocutusbefore 3.0.253.0.25Patch availableCNA
—locutus (npm)before 3.0.253.0.25Patch availableGHSA-4mph-v827-f877
  • locutus Vendorlocutusjs Affected before 3.0.25 Fixed in 3.0.25 Patch available CNA
  • locutus (npm) Vendor— Affected before 3.0.25 Fixed in 3.0.25 Patch available GHSA-4mph-v827-f877

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:locutus:locutus:*:*:*:*:*:node.js:*:*before 3.0.25Vulnerablelocutusjs
  • cpe:2.3:a:locutus:locutus:*:*:*:*:*:node.js:*:* Versions before 3.0.25 Vulnerable ·locutusjs

Remediation

  • Fix · CNA locutus (locutusjs) Fixed in 3.0.25
  • Fix · GHSA-4mph-v827-f877 locutus (npm) Fixed in 3.0.25 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Out of support scope

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33993
  2. 2026-10-03 Alias added: GHSA-4mph-v827-f877
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2026-24833 Locutus: RCE via unsanitized input in create_function() CVSS 3.1CRITICAL 9.8
  • TI-2026-23234 Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection CVSS 3.1HIGH 8.1
  • TI-2026-26334 Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521 CVSS 4.0MEDIUM 6.3
  • TI-2020-06239 Prototype pollution in locutus CVSS 3.1CRITICAL 9.8
  • TI-2026-20630 Locutus is vulnerable to Prototype Pollution CVSS 4.0CRITICAL 9.4
  • TI-2021-06085 Regular expression denial of service (ReDoS) in locutus CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences