A flaw in the parse_str function of the Locutus library allows an attacker to overwrite Object.prototype by hijacking RegExp.prototype.test. The vulnerability arises because the guard that replaces String.prototype.includes() with RegExp.prototype.test() is itself writable and can be overridden, enabling the prototype pollution guard to be bypassed. This flaw permits an attacker to inject arbitrary properties into all Object instances, potentially corrupting library behavior and affecting any code that relies on Object.prototype values. Such pollution can lead to logic errors, degrade data integrity, and provide a foothold for more serious attacks if combined with other weaknesses.

The issue affects the Locutus JavaScript library used in Node.js environments. Versions from 2.0.39 up to (but not including) 3.0.25 are vulnerable. Affected users run Locutus 2.x or the early 3.0.x releases without the update supplied in version 3.0.25.

The CVSS score of 6.3 places the vulnerability in the medium severity range. The EPSS score is below 1% and the vulnerability is not listed in CISA's KEV catalog, indicating a low exploitation likelihood. The attack vector is inferred to be via user-controlled input to parse_str, such as a crafted query string, after an attacker has been able to override RegExp.prototype.test. While the description does not explicitly state remote vs local scope, the nature of prototype pollution often enables persistence of exploitation across user sessions, making the impact potentially significant if the application trusts unchecked input.