Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| locutusjs | locutus | affected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-4mph-v827-f877 | Locutus has Prototype Pollution via __proto__ Key Injection in unserialize() |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Sat, 28 Mar 2026 03:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filtering the `__proto__` key. When a PHP serialized payload contains `__proto__` as an array or object key, JavaScript's `__proto__` setter is invoked, replacing the deserialized object's prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override. This is distinct from the previously reported prototype pollution in `parse_str` (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) — `unserialize` is a different function with no mitigation applied. Version 3.0.25 patches the issue. | |
| Title | Locutus has Prototype Pollution via __proto__ Key Injection in unserialize() | |
| Weaknesses | CWE-1321 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-03-27T22:14:03.495Z
Reserved: 2026-03-24T22:20:06.212Z
Link: CVE-2026-33993
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-27T23:17:14.237
Modified: 2026-03-27T23:17:14.237
Link: CVE-2026-33993
Redhat
No data.
OpenCVE Enrichment
No data.