Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

8 records

Vendor: locutusjs Clear all filters
TI-2026-24833 CVE-2026-32304 · GHSA-vh9h-29pq-r5m8

Locutus: RCE via unsanitized input in create_function()

Priority HIGH 82

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00647 Published 2026-03-12 Partial fix · 3.0.14 CWE-94
TI-2026-20630 CVE-2026-25521 · GHSA-rxrv-835q-v5mh

Locutus is vulnerable to Prototype Pollution

Priority MEDIUM 42

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes.

CVSS 4.0CRITICAL 9.4 Local No auth No interaction EPSS 0.00314 Published 2026-02-04 Fixed in 2.0.39 CWE-1321
TI-2021-06085 CVE-2021-23392 · GHSA-39q4-p535-c852

Regular expression denial of service (ReDoS) in locutus

Priority LOW 37

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01936 Published 2021-06-08 Fixed in 2.0.15 CWE-400
TI-2020-06239 CVE-2020-7719 · GHSA-f98m-q3hr-p5wq

Prototype pollution in locutus

Priority MEDIUM 47

Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02753 Published 2020-09-01 Fixed in 2.0.12 CWE-1321