CVE-2026-33994— Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521
Quick assessment
Affected
locutusjs locutus
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Locutus是Locutus开源的一个JavaScript代码库。 Locutus 2.0.39至3.0.25之前版本存在安全漏洞，该漏洞源于parse_str函数存在可绕过的原型污染防护，可能导致原型污染攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-33994
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521
Source: CVE Program / CVE List V5
Vulnerability Description
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototype pollution vulnerability exists in the `parse_str` function of the npm package locutus. An attacker can pollute `Object.prototype` by overriding `RegExp.prototype.test` and then passing a crafted query string to `parse_str`, bypassing the prototype pollution guard. This vulnerability stems from an incomplete fix for CVE-2026-25521. The CVE-2026-25521 patch replaced the `String.prototype.includes()`-based guard with a `RegExp.prototype.test()`-based guard. However, `RegExp.prototype.test` is itself a writable prototype method that can be overridden, making the new guard bypassable in the same way as the original — trading one hijackable built-in for another. Version 3.0.25 contains an updated fix.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1321
Source: CVE Program / CVE List V5
Vulnerability Title
Locutus 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Locutus是Locutus开源的一个JavaScript代码库。 Locutus 2.0.39至3.0.25之前版本存在安全漏洞，该漏洞源于parse_str函数存在可绕过的原型污染防护，可能导致原型污染攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-33994
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-33994
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-33994 (2)
Vendor Advisories for CVE-2026-33994 (1)
Vendor Pages for CVE-2026-33994 (1)
-
Release v3.0.25 · locutusjs/locutus · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: locutus
-
CVE-2026-33993
Locutus has Prototype Pollution via __proto__ Key Injection -
CVE-2026-32304
Locutus: RCE via unsanitized input in create_function() -
CVE-2026-29091
Locutus: Remote Code Execution (RCE) in locutus call_user_fu -
CVE-2026-25521
Locutus is vulnerable to Prototype Pollution -
CVE-2021-23392
Regular Expression Denial of Service (ReDoS)
Same vendor: locutusjs
Same weakness: CWE-1321
-
CVE-2026-78654
cleverbrush framework/deep deepExtend.ts deepExtend prototyp -
CVE-2026-78181
ractivejs ractive Keypath Ractive#set prototype pollution -
CVE-2026-78180
alibaba-fusion next deepMerge index.tsx ConfigProvider.getCo -
CVE-2026-78179
rexrainbow phaser3-rex-notes BehaviorTree Blackboard Data Se -
CVE-2026-78178
jQWidgets jqx-all.js jqxBaseFramework.extend prototype pollu
V. Comments for CVE-2026-33994
No comments yet