Locutus is a niche JavaScript and PHP development framework whose vulnerability profile is marked by a strong tendency toward critical-severity outcomes. The recurring exposure centers on the core Locutus and Locutus PHP products and clusters around code-injection and dynamic-evaluation weaknesses—including prototype pollution, code injection, eval injection, and OS command injection—that reflect the framework's approach to dynamic language features and object manipulation. Defenders tracking this framework should prioritize patching and monitor for upgrade guidance; live severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Locutus over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-32304CRITICAL Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters direc | Mar 13, 2026 | 9.8 | 33 | NO | NO |
CVE-2020-13619CRITICAL php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution. | Jul 1, 2020 | 9.8 | 32 | NO | NO |
CVE-2026-25521HIGH Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists i | Feb 4, 2026 | 8.8 | 31 | NO | NO |
CVE-2026-33994CRITICAL Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototype pollution vulnerab | Mar 27, 2026 | 9.8 | 30 | NO | NO |
CVE-2026-33993CRITICAL Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus/php/var/unserialize` | Mar 27, 2026 | 9.8 | 30 | NO | NO |
CVE-2026-29091HIGH Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locut | Mar 6, 2026 | 8.1 | 30 | NO | NO |
CVE-2020-7719CRITICAL Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function. | Sep 1, 2020 | 9.8 | 30 | NO | NO |
CVE-2021-23392HIGH The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function. | Jun 8, 2021 | 7.5 | 24 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Locutus.
Media articles that mention a CVE ID that affects a product developed by Locutus — matched by CVE ID, not by vendor name.