CVE-2026-25521High· 8.8▾ TwilightLocutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitig…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.3%
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.
locutus >= 2.0.12, < 2.0.39Upgrade past the affected range:
locutus 2.0.39Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61834Medium· 4.3scim-patch is a library for applying SCIM patch operations
CVE-2026-90771Low· 3.7joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code
CVE-2026-85063Medium· 6.5node-csv is a full-featured CSV parser with a simple API that is tested against large datasets
CVE-2026-63376High· 8.2toml-node is a TOML parser for Node.js and the browser
CVE-2026-73088High· 7.5Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools
CVE-2026-46625High· 7.5JavaScript Cookie is a JavaScript API for handling cookies, client-side