CVE-2026-25521

The previous patch attempted to block prototype pollution by checking whether user input contains forbidden keys. However, an attacker can provide crafted input exploiting String.prototype, which allows bypassing this security measure and still polluting Object.prototype. Modification of Object.prototype affects all objects in a given JavaScript environment, which may lead to changes in the application's logic. The vulnerability is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes).

An attacker can modify properties of the global Object.prototype, which may result in unauthorized access to resources, bypass of authentication or authorization mechanisms, and in specific scenarios also arbitrary code execution in the context of the application.

The Locutus library should be updated to version 2.0.39 or newer, in which the vulnerability has been fixed. Details are available in the vendor references on GitHub.

Locutus library in versions from 2.0.12 to 2.0.38 (inclusive).