Executive brief
Locutus is a popular JavaScript library that provides PHP function implementations, including the unserialize() function for deserializing PHP-serialized data. The library fails to filter the __proto__ key during deserialization, allowing attackers to inject malicious properties into deserialized objects. This can lead to authorization bypass (if code checks properties like isAdmin), property propagation when objects are copied, and denial of service by overriding built-in methods like hasOwnProperty().
Technical details
The vulnerability exists in the expectArrayItems() and expectObject() functions within src/php/var/unserialize.ts. Both functions create plain objects ({}) and assign deserialized keys via bracket notation (e.g., items[String(key[0])] = item[0]) without filtering. When the key is __proto__, JavaScript's __proto__ setter is invoked, replacing the object's [[Prototype]] rather than creating a regular property. This allows attackers to inject inherited properties that are accessible via dot notation and the 'in' operator but hidden from Object.keys() and hasOwnProperty(). Injected properties can also propagate to copies made via for...in loops, becoming real own properties. Additionally, attackers can override Object.prototype methods with non-function values, causing TypeErrors. The attack surface is realistic since unserialize() commonly deserializes untrusted PHP-serialized data. The vulnerability was fixed in version 3.0.25 by filtering dangerous keys (__proto__, constructor, prototype) and defining them as plain own properties via Object.defineProperty() instead of bracket notation.
Affected products
- locutusjs locutus < 3.0.25
Timeline
- 2026-03-27: disclosed
- 2026-03-25: patched: Fixed in v3.0.25