Locutus: community verdicts

1 notable / known-exploited Locutus CVE the community has triaged.

ⓘ Not an exhaustive list: we focus on the findings that matter (exploited / notable). For every Locutus CVE, see NVD ↗.

CVE-2026-25521HIGH 8.8Real · low riskEPSS 0%
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.