Attacker-controlled keys named __proto__ can replace the prototype of deserialized objects, allowing injection of arbitrary properties and overriding built-in methods. This vulnerability can lead to injection of malicious code or denial of service, specifically through property propagation during for…in loops or by tampering with standard object behavior.

The problem exists in the Locutus library for JavaScript under the product locutusjs:locutus. All releases before version 3.0.25 generate objects via bracket notation without filtering the __proto__ key, so versions less than 3.0.25 are affected. Version 3.0.25 onward includes the fix.

The vulnerability has a CVSS score of 6.9, indicating a moderate to high severity. No EPSS score is available and the issue is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The likely attack vector is the application of a PHP serialized string containing a __proto__ key to the unserialize() function, which then mutates the JavaScript prototype chain. This can be leveraged if the library processes untrusted input in a client- or server-side context.