{"action":"Upgrade locutus to 2.0.39 or later.","affected":[{"fixed":"2.0.39","introduced":"2.0.12"}],"component":"locutus","cve_ids":["CVE-2026-25521"],"ecosystem":"npm","epss":0.00319,"exploited":false,"fixed_versions":["2.0.39"],"ghsa_id":"GHSA-rxrv-835q-v5mh","id":"tcs_01M5KGA9JBGHN53F2XZRY423WK","modified_at":"2026-10-05T15:45:04.416035427Z","published_at":"2026-02-02T22:21:54Z","references":["https://osv.dev/vulnerability/GHSA-rxrv-835q-v5mh","https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh","https://nvd.nist.gov/vuln/detail/CVE-2026-25521","https://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c","https://access.redhat.com/security/cve/CVE-2026-25521","https://bugzilla.redhat.com/show_bug.cgi?id=2436950","https://github.com/locutusjs/locutus","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25521.json"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-rxrv-835q-v5mh","url":"https://osv.dev/vulnerability/GHSA-rxrv-835q-v5mh"}],"summary":"locutus is vulnerable to Prototype Pollution"}