CVE-2026-33994
Locutus 2.0.39 – 3.0.25
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-33994 is a medium-severity Prototype Pollution (CWE-1321) vulnerability in Locutus Locutus. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33994 is a prototype pollution vulnerability in the `parse_str` function of the Locutus npm package, which ports standard libraries from other programming languages to JavaScript for educational purposes. The issue affects versions starting from 2.0.39 and prior to 3.0.25. It arises from an incomplete fix for the prior CVE-2026-25521, where a guard against prototype pollution was switched from `String.prototype.includes()` to `RegExp.prototype.test()`. However, `RegExp.prototype.test` is a writable prototype method that can itself be overridden, allowing bypass of the new guard. The vulnerability is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes).
An attacker can exploit this by first overriding `RegExp.prototype.test` and then supplying a crafted query string to the `parse_str` function, enabling pollution of `Object.prototype`. Exploitation requires no privileges or user interaction and can occur remotely over a network with low complexity. Successful pollution of `Object.prototype` can lead to high confidentiality, integrity, and availability impacts, potentially allowing arbitrary code execution or other severe consequences in applications that process untrusted input through Locutus.
The GitHub security advisory (GHSA-vc8f-x9pp-wf5p) and related commit (345a6211e1e6f939f96a7090bfeff642c9fcf9e4), pull request (#597), and release notes for v3.0.25 detail the updated fix in version 3.0.25, which addresses the bypass by implementing a more robust prototype pollution guard. Security practitioners should upgrade to Locutus 3.0.25 or later and audit usage of `parse_str` with untrusted inputs.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16890
Vulnerability Data
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototype pollution vulnerability exists in the `parse_str` function of the npm package locutus. An attacker can pollute `Object.prototype`…
more
by overriding `RegExp.prototype.test` and then passing a crafted query string to `parse_str`, bypassing the prototype pollution guard. This vulnerability stems from an incomplete fix for CVE-2026-25521. The CVE-2026-25521 patch replaced the `String.prototype.includes()`-based guard with a `RegExp.prototype.test()`-based guard. However, `RegExp.prototype.test` is itself a writable prototype method that can be overridden, making the new guard bypassable in the same way as the original — trading one hijackable built-in for another. Version 3.0.25 contains an updated fix.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.3.6
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and safe property assignment to prevent prototype pollution.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle mandates input validation and object-handling controls that directly prevent prototype pollution.
Application security requirements explicitly call for safeguards against unsafe object attribute manipulation.
Secure architecture principles reduce the likelihood of prototype pollution through safe design patterns.
Secure coding standards directly prohibit unsafe prototype attribute assignment and require defensive checks.
Security testing in development catches prototype-pollution flaws before release.
Change-management processes ensure security fixes for prototype-pollution issues are tracked and deployed.