PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-25521 locutusjs CVE debrief

CVE-2026-25521 is a critical vulnerability in Locutus, a JavaScript library that brings standard libraries of other programming languages to JavaScript for educational purposes. The vulnerability, with a CVSS score of 9.4, allows for prototype pollution via a crafted input using String.prototype. This issue exists in versions from 2.0.12 to before 2.0.39. Despite a previous fix attempting to mitigate prototype pollution, it is still possible to pollute Object.prototype. The vulnerability has been patched in version 2.0.39. Users of affected versions should update to 2.0.39 or later to mitigate this vulnerability.

Vendor
locutusjs
Product
locutus
CVSS
CRITICAL 9.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-04
Original CVE updated
2026-07-15
Advisory published
2026-02-04
Advisory updated
2026-07-15

Who should care

Developers and administrators using Locutus versions between 2.0.12 and 2.0.39 should be aware of this critical vulnerability. Given the high CVSS score, immediate attention is required to prevent potential exploitation. This vulnerability could allow attackers to manipulate the Object.prototype, potentially leading to security issues in applications using Locutus.

Technical summary

The CVE-2026-25521 vulnerability in Locutus is caused by a prototype pollution issue. This occurs when an attacker can modify the prototype of an object, in this case, Object.prototype, using a crafted input through String.prototype. The vulnerability has a CVSS score of 9.4, indicating critical severity. It affects Locutus versions from 2.0.12 up to but not including 2.0.39. The issue was initially mitigated but not fully resolved, allowing for continued exploitation. The fix in version 2.0.39 addresses this vulnerability by properly preventing prototype pollution.

Defensive priority

High. Immediate action is required to update affected installations of Locutus to version 2.0.39 or later to prevent potential exploitation of this critical vulnerability.

Recommended defensive actions

  • Update Locutus to version 2.0.39 or later.
  • Review and inventory applications using Locutus to ensure they are not exposed.
  • Implement monitoring to detect potential exploitation attempts.
  • Consider compensating controls if immediate update is not feasible.
  • Track vendor advisories for further information.

Evidence notes

The CVE-2026-25521 vulnerability details were obtained from the NVD and CVE.org. The vulnerability affects Locutus versions between 2.0.12 and 2.0.39. A patch is available in version 2.0.39. Additional information and references can be found in the source item and resource links provided.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-25521 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-25521

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-25521 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-25521

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c

    [email protected] - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh

    [email protected] - Exploit, Vendor Advisory

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/security/cve/CVE-2026-25521

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

  • Source reference

    Unverified legacy reference

    URL: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25521.json

    0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.