CVE-2026-25521

CVE-2026-25521 is a high-severity prototype pollution vulnerability affecting Locutus versions 2.0.12 through 2.0.38, a library that integrates other programming language standard libraries into JavaScript. An attacker can exploit this flaw by crafting malicious input through String.prototype, despite previous attempts to mitigate such issues. This vulnerability carries a CVSS score of 8.8, indicating a high potential for impact including confidentiality, integrity, and availability compromise, with low attack complexity and local privileges required. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.