Locutusjs vulnerabilities
We track 5 vulnerabilities in Locutusjs products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on March 27, 2026.
Latest Locutusjs vulnerabilities
- 9.8 Critical severity
locutus: Improperly Controlled Modification of Object Prototype Attributes
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototype pollution vulnerability exists in the `parse_str` function of the npm package locutus. An attacker
- 9.8 Critical severity
locutus: Improperly Controlled Modification of Object Prototype Attributes
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filteri
- 9.8 Critical severity
locutus: Improper Control of Generation of Code
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary cod
- 8.1 High severity
locutus: Improper Neutralization of Directives in Dynamically Evaluated Code
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation
- 8.8 High severity
locutus: Improperly Controlled Modification of Object Prototype Attributes
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution