Locutus implements a PHP‑style unserialize function that deserializes keys into plain JavaScript objects without filtering the special __proto__ key. When an attacker supplies a serialized payload that contains __proto__ as a key, JavaScript’s prototype setter is invoked, which can replace the object’s prototype with attacker‑controlled data. This results in prototype pollution that allows the attacker to inject arbitrary properties into objects, cause unintended property enumeration and override built‑in methods, leading to potential denial of service or other compromise of data integrity.

The vulnerability affects the Locutus library distributed as the npm package locutusjs/locutus. All versions prior to 3.0.25 are affected. Users who load older versions of locutus and invoke the unserialize function on untrusted data are at risk.

The CVSS score of 6.9 indicates higher‑moderate risk, whereas the EPSS score of less than 1 % suggests the likelihood of exploitation in the wild is low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to control the input passed to unserialize; if the function is used on user‑supplied data, injecting a __proto__ key can modify object prototypes. The attack vector is inferred to be remote input to the JavaScript runtime, as the vulnerable function is client‑side. Successful exploitation could lead to property injection, unwanted enumeration and possibly denial of service.