# locutus (npm) vulnerabilities 8 known vulnerabilities (3 critical, 1 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.0.36 (May 16, 2026): no advisory affects it - Newest unaffected release: 3.0.36 (May 16, 2026), the latest release - Weekly downloads: 789.4K - Dependents: 94 - Releases: 63 since 0.0.1 (Apr 18, 2016) - Registry: https://www.npmjs.com/package/locutus - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-33994: 2.0.39 to 3.0.24 (3.0.25 is outside it) - CVE-2026-33993: 0.0.1 to 3.0.24 (3.0.25 is outside it) - CVE-2026-32304: 0.0.1 to 3.0.13 (3.0.14 is outside it) - CVE-2026-29091: 0.0.1 to 2.0.39 (3.0.0 is outside it) - CVE-2026-25521: 2.0.12 to 2.0.38 (2.0.39 is outside it) - CVE-2021-23392: 0.0.1 to 2.0.14 (2.0.15 is outside it) - CVE-2020-7719: 0.0.1 to 2.0.11 (2.0.12 is outside it) - CVE-2020-13619: 0.0.1 to 2.0.11 (2.0.12 is outside it) ## Advisories (8) ### [CVE-2026-33994](https://cve.now/CVE-2026-33994): Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521 - Severity: Medium 6.3 - Published: Mar 27, 2026 - Affected: from 2.0.39, fixed in 3.0.25. - Fixed in 3.0.25 (released Mar 25, 2026, 2 days before disclosure). - The latest release, 3.0.36, is not affected. - 28% of locutus downloads last week were affected versions (218.7K). ### [CVE-2026-33993](https://cve.now/CVE-2026-33993): Locutus has Prototype Pollution via proto Key Injection in unserialize() - Severity: Medium 6.9 - Published: Mar 27, 2026 - Affected: fixed in 3.0.25. - Fixed in 3.0.25 (released Mar 25, 2026, 2 days before disclosure). - The latest release, 3.0.36, is not affected. - 80% of locutus downloads last week were affected versions (631.3K). ### [CVE-2026-32304](https://cve.now/CVE-2026-32304): Locutus: RCE via unsanitized input in create\_function() - Severity: Critical 9.8 - Published: Mar 12, 2026 - Affected: fixed in 3.0.14. - Fixed in 3.0.14 (released Mar 11, 2026, 1 day before disclosure). - The latest release, 3.0.36, is not affected. - 79% of locutus downloads last week were affected versions (620K). ### [CVE-2026-29091](https://cve.now/CVE-2026-29091): Locutus: Remote Code Execution (RCE) in locutus call\_user\_func\_array due to Code Injection - Severity: High 8.1 - Published: Mar 6, 2026 - Affected: fixed in 3.0.0. - Fixed in 3.0.0 (released Mar 3, 2026, 3 days before disclosure). - The latest release, 3.0.36, is not affected. - 79% of locutus downloads last week were affected versions (619.9K). ### [CVE-2026-25521](https://cve.now/CVE-2026-25521): Locutus is vulnerable to Prototype Pollution - Severity: Critical 9.4 - Published: Feb 4, 2026 - Affected: from 2.0.12, fixed in 2.0.39. - Fixed in 2.0.39 (released Feb 2, 2026, 2 days before disclosure). - The latest release, 3.0.36, is not affected. - 50% of locutus downloads last week were affected versions (395K). ### [CVE-2021-23392](https://cve.now/CVE-2021-23392): Regular Expression Denial of Service (ReDoS) - Severity: Medium 5.3 - Published: Jun 8, 2021 - Affected: fixed in 2.0.15. - Fixed in 2.0.15 (released May 27, 2021, 12 days before disclosure). - The latest release, 3.0.36, is not affected. - 2.9% of locutus downloads last week were affected versions (22.8K). ### [CVE-2020-7719](https://cve.now/CVE-2020-7719): Prototype Pollution - Severity: Critical 9.8 - Published: Sep 1, 2020 - Affected: fixed in 2.0.12. - Fixed in 2.0.12 (released Sep 3, 2020, 2 days after disclosure). - The latest release, 3.0.36, is not affected. - 2.2% of locutus downloads last week were affected versions (17.6K). ### [CVE-2020-13619](https://cve.now/CVE-2020-13619): php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution. - Severity: Unrated - Published: Jul 1, 2020 - Affected: through 2.0.11. - Fixed in 2.0.12 (released Sep 3, 2020, 64 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.0.36, is not affected. - 2.2% of locutus downloads last week were affected versions (17.6K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/locutus Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.