Locutus is a JavaScript library that offers standard library functionality from other languages for educational purposes. Between versions 2.0.12 and before 2.0.39 a prototype pollution flaw allows an attacker to craft input that exploits String.prototype and writes to Object.prototype. By overwriting properties on the global prototype, the attacker can alter the behavior of all future objects in the JavaScript runtime, potentially leading to privilege escalation or arbitrary code execution. The flaw is classified as CWE‑1321 and CWE‑915.

The vulnerable product is the Locutus library for Node.js. Applications that import any part of Locutus between versions 2.0.12 and 2.0.38—directly or via transitive dependencies—are affected. Version 2.0.39 and later contain the repair that blocks the pollution vector.

The vulnerability receives a CVSS score of 9.4, indicating very high severity, yet the EPSS probability is reported as less than 1 %, suggesting a low but non‑zero chance of exploitation. The flaw is not listed in the CISA KEV catalog. Attackers that can supply data to the vulnerable functions—such as through web request handlers, APIs, or any untrusted input—can trigger the prototype pollution without elevated privileges. The attack path relies on manipulating String.prototype keys, making it practical for remote clients that invoke the library functions.