CVE-2026-33993
Locutus: Locutus: Prototype Pollution and Denial of Service vulnerability in unserialize() function
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon GHSA (moyenne), Red Hat (moyenne).
Description
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filtering the `__proto__` key. When a PHP serialized payload contains `__proto__` as an array or object key, JavaScript's `__proto__` setter is invoked, replacing the deserialized object's prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override. This is distinct from the previously reported prototype pollution in `parse_str` (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) — `unserialize` is a different function with no mitigation applied. Version 3.0.25 patches the issue.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| npm::GitHub Security Advisory npm | locutus | 3.0.25 |
Références
- https://access.redhat.com/security/cve/CVE-2026-33993
- https://github.com/locutusjs/locutus
- https://github.com/locutusjs/locutus/commit/345a6211e1e6f939f96a7090bfeff642c9fcf9e4
- https://github.com/locutusjs/locutus/pull/597
- https://github.com/locutusjs/locutus/releases/tag/v3.0.25
- https://github.com/locutusjs/locutus/security/advisories/GHSA-4mph-v827-f877
- https://nvd.nist.gov/vuln/detail/CVE-2026-33993
- https://www.cve.org/CVERecord?id=CVE-2026-33993