CVE-2026-33993

Description

A flaw was found in Locutus, a library that integrates standard libraries from other programming languages into JavaScript. The unserialize() function, which converts serialized PHP data into JavaScript objects, fails to filter the __proto__ key during deserialization. A remote attacker can exploit this by providing a specially crafted PHP serialized payload that includes __proto__ as an array or object key. This vulnerability, known as prototype pollution, allows for property injection and can lead to a Denial of Service (DoS) by enabling attackers to override built-in JavaScript methods.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score5.39.8N/A
Attack VectorNetworkNetworkN/A
Attack ComplexityLowLowN/A
Privileges RequiredNoneNoneN/A
User InteractionNoneNoneN/A
ScopeUnchangedUnchangedN/A
ConfidentialityNoneHighN/A
Integrity ImpactLowHighN/A
Availability ImpactNoneHighN/A

Vector

Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Understanding the Weakness (CWE)

CWE-915

Integrity

Technical Impact: Modify Application Data

An attacker could modify sensitive data or program variables.

Integrity

Technical Impact: Execute Unauthorized Code or Commands

Other,Integrity

Technical Impact: Varies by Context; Alter Execution Logic

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.