CVE-2026-33994
Prototype Pollution in Locutus `parse_str` Allows Object Hijacking
Publication date: 2026-03-27
Last updated on: 2026-04-01
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| locutus | locutus | From 2.0.39 (inc) to 3.0.25 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1321 | The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the npm package locutus, specifically in the parse_str function between versions 2.0.39 and before 3.0.25. It is a prototype pollution vulnerability that allows an attacker to modify Object.prototype by overriding RegExp.prototype.test and then passing a crafted query string to parse_str. The issue arises because the guard meant to prevent prototype pollution uses RegExp.prototype.test, which itself can be overridden, allowing the attacker to bypass the protection.
This vulnerability is a result of an incomplete fix for a previous vulnerability (CVE-2026-25521), where the original guard using String.prototype.includes() was replaced with RegExp.prototype.test(), but since RegExp.prototype.test is writable, the new guard can also be bypassed. The vulnerability was fixed in version 3.0.25 with an updated fix.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can perform prototype pollution, which means they can modify the base Object prototype in JavaScript. This can lead to unexpected behavior in applications using the vulnerable parse_str function, potentially causing security issues such as denial of service, data manipulation, or execution of arbitrary code depending on how the polluted prototype is used.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade the npm package locutus to version 3.0.25 or later, as this version contains an updated fix for the prototype pollution issue in the parse_str function.