CVE-2026-33993
Prototype Pollution in Locutus PHP Unserialize Enables DoS and Injection
Publication date: 2026-03-27
Last updated on: 2026-04-01
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| locutus | locutus | to 3.0.25 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1321 | The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Locutus library, specifically in the unserialize() function of locutus/php/var/unserialize prior to version 3.0.25. When deserializing PHP serialized data, the function assigns keys to plain JavaScript objects without filtering out the __proto__ key. If an attacker includes __proto__ as a key in the serialized payload, it triggers JavaScript's __proto__ setter, which replaces the object's prototype with attacker-controlled content. This leads to prototype pollution, enabling property injection, propagation of injected properties during for...in loops, and potential denial of service by overriding built-in methods.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to inject properties into objects via prototype pollution. This can cause unexpected behavior in the application, including the propagation of malicious properties through object iterations and denial of service by overriding critical built-in methods. Such impacts can compromise application stability and security.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Locutus to version 3.0.25 or later, where the issue with the unserialize() function assigning deserialized keys without filtering the __proto__ key has been patched.