CVE-2026-33993
Locutus ≤ 3.0.25
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-33993 is a medium-severity Prototype Pollution (CWE-1321) vulnerability in Locutus Locutus. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 46th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33993 is a prototype pollution vulnerability in the Locutus JavaScript library, which emulates standard libraries from other programming languages for educational purposes. The issue affects the `unserialize()` function located in `locutus/php/var/unserialize` in versions prior to 3.0.25. This function deserializes PHP serialized payloads by assigning keys to plain JavaScript objects using bracket notation without filtering the `__proto__` key. When a payload includes `__proto__` as an array or object key, it triggers JavaScript's `__proto__` setter, allowing attackers to replace the object's prototype with controlled content. The vulnerability is rated at CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes).
Any unauthenticated remote attacker can exploit this vulnerability by providing a specially crafted PHP serialized payload to an application using the affected `unserialize()` function. Successful exploitation enables property injection onto the polluted prototype, which can propagate through for...in loops to other objects. Attackers can also achieve denial of service by overriding built-in methods. This issue is distinct from prior prototype pollution vulnerabilities in Locutus's `parse_str` function, as `unserialize()` lacked specific mitigations.
The Locutus project addressed this in version 3.0.25 via a patch that filters the `__proto__` key during deserialization. Security practitioners should upgrade to this version or later. Relevant resources include the patching commit at https://github.com/locutusjs/locutus/commit/345a6211e1e6f939f96a7090bfeff642c9fcf9e4, pull request https://github.com/locutusjs/locutus/pull/597, release notes at https://github.com/locutusjs/locutus/releases/tag/v3.0.25, and the security advisory at https://github.com/locutusjs/locutus/security/advisories/GHSA-4mph-v827-f877.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16888
Vulnerability Data
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filtering the `__proto__` key. When a PHP serialized payload…
more
contains `__proto__` as an array or object key, JavaScript's `__proto__` setter is invoked, replacing the deserialized object's prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override. This is distinct from the previously reported prototype pollution in `parse_str` (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) — `unserialize` is a different function with no mitigation applied. Version 3.0.25 patches the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.3.6
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and safe property assignment to prevent prototype pollution.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle mandates input validation and object-handling controls that directly prevent prototype pollution.
Application security requirements explicitly call for safeguards against unsafe object attribute manipulation.
Secure architecture principles reduce the likelihood of prototype pollution through safe design patterns.
Secure coding standards directly prohibit unsafe prototype attribute assignment and require defensive checks.
Security testing in development catches prototype-pollution flaws before release.
Change-management processes ensure security fixes for prototype-pollution issues are tracked and deployed.