9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25521

CVE-2026-25521: locutus is vulnerable to Prototype Pollution

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25521

CVE-2026-25521:

9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
locutus	npm	>= 2.0.12, < 2.0.39	2.0.39

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided security advisory and the associated commit 042af9ca7fde2ff599120783e720a17f335bb01c clearly indicates a prototype pollution vulnerability within the locutus package. The vulnerability was located in the parse_str function in the file src/php/strings/parse_str.js. The patch file shows that the developers replaced a call to String.prototype.includes() with a regular expression test (/__proto__|constructor|prototype/.test(key)). The commit message explicitly states that this change was made to prevent a bypass where String.prototype.includes could be overridden by an attacker. The vulnerability description and Proof of Concept confirm that by manipulating String.prototype.includes, an attacker could successfully pollute the Object prototype. Therefore, the parse_str function is the identified vulnerable function.

Vulnerable functions

parse_str

src/php/strings/parse_str.js

The function `parse_str` was vulnerable to prototype pollution. It used `key.includes()` to check for malicious keys like `__proto__`, `constructor`, or `prototype`. However, an attacker could override the `String.prototype.includes` function to always return `false`, bypassing this security check. This allowed the attacker to inject properties into `Object.prototype`, leading to a prototype pollution vulnerability. The patch replaced the vulnerable `includes()` check with a regular expression test, which is not susceptible to this kind of tampering.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.