CVE-2026-33994
Published: 27 March 2026
Description
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototype pollution vulnerability exists in the `parse_str` function of the npm package locutus. An attacker can pollute `Object.prototype`…
more
by overriding `RegExp.prototype.test` and then passing a crafted query string to `parse_str`, bypassing the prototype pollution guard. This vulnerability stems from an incomplete fix for CVE-2026-25521. The CVE-2026-25521 patch replaced the `String.prototype.includes()`-based guard with a `RegExp.prototype.test()`-based guard. However, `RegExp.prototype.test` is itself a writable prototype method that can be overridden, making the new guard bypassable in the same way as the original — trading one hijackable built-in for another. Version 3.0.25 contains an updated fix.
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the prototype pollution vulnerability by requiring timely application of the vendor patch in Locutus version 3.0.25.
Requires validation of untrusted inputs prior to processing by the vulnerable parse_str function, preventing crafted query strings from bypassing the prototype pollution guard.
Enables identification of the vulnerable Locutus package versions through vulnerability scanning, allowing proactive remediation before exploitation.
Security SummaryAI
CVE-2026-33994 is a prototype pollution vulnerability in the `parse_str` function of the Locutus npm package, which ports standard libraries from other programming languages to JavaScript for educational purposes. The issue affects versions starting from 2.0.39 and prior to 3.0.25. It arises from an incomplete fix for the prior CVE-2026-25521, where a guard against prototype pollution was switched from `String.prototype.includes()` to `RegExp.prototype.test()`. However, `RegExp.prototype.test` is a writable prototype method that can itself be overridden, allowing bypass of the new guard. The vulnerability is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes).
An attacker can exploit this by first overriding `RegExp.prototype.test` and then supplying a crafted query string to the `parse_str` function, enabling pollution of `Object.prototype`. Exploitation requires no privileges or user interaction and can occur remotely over a network with low complexity. Successful pollution of `Object.prototype` can lead to high confidentiality, integrity, and availability impacts, potentially allowing arbitrary code execution or other severe consequences in applications that process untrusted input through Locutus.
The GitHub security advisory (GHSA-vc8f-x9pp-wf5p) and related commit (345a6211e1e6f939f96a7090bfeff642c9fcf9e4), pull request (#597), and release notes for v3.0.25 detail the updated fix in version 3.0.25, which addresses the bypass by implementing a more robust prototype pollution guard. Security practitioners should upgrade to Locutus 3.0.25 or later and audit usage of `parse_str` with untrusted inputs.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVSS AV:N/AC:L/PR:N/UI:N enables remote unauthenticated exploitation of applications processing untrusted input via Locutus parse_str, such as public-facing web services parsing query strings, directly facilitating T1190: Exploit Public-Facing Application.