CVE-2026-33993: Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()

The unserialize() function in locutus/php/var/unserialize assigns deserialized keys to plain objects via bracket notation without filtering the __proto__ key. When a PHP serialized payload contains __proto__ as an array or object key, JavaScript’s __proto__ setter is invoked, replacing the deserialized object’s prototype with attacker-controlled content. This enables property injection, for…in propagation of injected properties, and denial of service via built-in method override.

This is distinct from the previously reported prototype pollution in parse_str (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) — unserialize is a different function with no mitigation applied.