CVE-2026-33993 PUBLISHED

Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()

Assigner: GitHub_M
Reserved: 24.03.2026 Published: 27.03.2026 Updated: 27.03.2026

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the unserialize() function in locutus/php/var/unserialize assigns deserialized keys to plain objects via bracket notation without filtering the __proto__ key. When a PHP serialized payload contains __proto__ as an array or object key, JavaScript's __proto__ setter is invoked, replacing the deserialized object's prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override. This is distinct from the previously reported prototype pollution in parse_str (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) — unserialize is a different function with no mitigation applied. Version 3.0.25 patches the issue.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor locutusjs
Product locutus
Versions
  • Version < 3.0.25 is affected

References

Problem Types

  • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') CWE