CVE-2026-25521 - Locutus is vulnerable to Prototype Pollution

CVE ID : CVE-2026-25521 Published : Feb. 4, 2026, 9:20 p.m. | 24 minutes ago Description : Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...