Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A prototype pollution vulnerability exists in the parsestr function of the npm package locutus. An attacker can pollute Object.prototype by overriding RegExp.prototype.test and then passing a crafted query string to parsestr, bypassing the prototype pollution guard. This vulnerability stems from an incomplete fix for CVE-2026-25521. The CVE-2026-25521 patch replaced the String.prototype.includes()-based guard with a RegExp.prototype.test()-based guard. However, RegExp.prototype.test is itself a writable prototype method that can be overridden, making the new guard bypassable in the same way as the original — trading one hijackable built-in for another. Package locutus (npm) Affected versions = 2.0.39, <= 3.0.24 Tested and confirmed vulnerable on 2.0.39 and 3.0.24 (latest). Version 2.0.38 (pre-fix) uses a different guard (String.prototype.includes) and is not affected by this specific bypass. --- Description Details The vulnerability resides in parsestr.js where the…
Recommended action: Upgrade to 3.0.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The unserialize() function in locutus/php/var/unserialize assigns deserialized keys to plain objects via bracket notation without filtering the proto key. When a PHP serialized payload contains proto as an array or object key, JavaScript's proto setter is invoked, replacing the deserialized object's prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override. This is distinct from the previously reported prototype pollution in parsestr (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) — unserialize is a different function with no mitigation applied. Details The vulnerable code is in two functions within src/php/var/unserialize.ts: expectArrayItems() at line 358: expectObject() at line 278: Both functions create a plain object ({}) and assign user-controlled keys via bracket notation. When the key is proto, JavaScript's proto setter replaces the object's prototype rather…
Recommended action: Upgrade to 3.0.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The createfunction(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 (GHSA-fp25-p6mj-qqg6) which was calluserfuncarray using eval() in v2.x. This finding affects createfunction using new Function() in v3.x. Root Cause src/php/funchand/createfunction.ts:17: Zero input validation on either parameter. PoC Confirmed on locutus v3.0.11, Node.js v24.13.1. Impact Full RCE when an attacker can control either argument to createfunction(). 597K weekly npm downloads. Suggested Fix Remove createfunction or replace new Function() with a safe alternative. PHP itself deprecated createfunction() in PHP 7.2 for the same reason. Response Thanks for the report. We confirmed that php/funchand/createfunction was still present through locutus@3.0.13 and that it exposed dynamic code execution via new Function(...). While this was intended behavior, createfunction()…
Recommended action: Upgrade to 3.0.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Details A Remote Code Execution (RCE) flaw was discovered in the locutus project (v2.0.39), specifically within the calluserfuncarray function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the calluserfuncarray function (and its wrapper calluserfunc), which fails to properly validate all components of a callback array before passing them to eval(). ------ Technical Details The vulnerability is in the calluserfuncarray function in src/php/funchand/calluserfuncarray.js, between lines 31 and 35 of version 2.0.39. This function mimics PHP's dynamic function call feature and accepts a callback argument, which can be a string (function name) or an array (class and method name). The developers applied a regular expression check (validJSFunctionNamePattern) to the first array element (the class identifier), but not to the second element (the method…
Recommended action: Upgrade to 3.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Prototype Pollution vulnerability exists in the the npm package locutus (2.0.12). Despite a previous fix that attempted to mitigate Prototype Pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue was fixed in version 2.0.39. Details The vulnerability resides in line 77 to 79 of https://github.com/locutusjs/locutus/blob/main/src/php/strings/parsestr.js where includes() function is used to check whether user provided input contain forbidden strings. PoC Steps to reproduce 1. Install latest version of locutus using npm install or cloning from git 2. Run the following code snippet: Expected behavior Prototype Pollution should be prevented and {} should not gain new properties. This should be printed on the console: Actual behavior Object.prototype is polluted This is printed on the console: Impact This is a Prototype Pollution vulnerability, which can have…
Recommended action: Upgrade to 2.0.39 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The package locutus before 2.0.15 is vulnerable to Regular Expression Denial of Service (ReDoS) via the gopherparsedir function.
Recommended action: Upgrade to 2.0.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
All versions of package locutus prior to version 2.0.12 are vulnerable to Prototype Pollution via the php.strings.parsestr function.
Recommended action: Upgrade to 2.0.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.