CVE-2026-29091
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
A remote code execution (RCE) vulnerability was discovered in the Locutus project, which ports standard libraries from other programming languages to JavaScript. The flaw affects the call_user_func_array function and its wrapper call_user_func, which fail to properly validate callback array components before passing them to eval().
Risk Assessment
An attacker can inject arbitrary JavaScript code into the application's runtime environment, leading to full application compromise, data theft, or further attacks on the infrastructure.
Recommendation
Immediately update the Locutus library to version 3.0.0 or later, which contains the fix for this vulnerability.
Other vulnerabilities in Locutus
See all- CVE-2026-32304Critical
In the Locutus library prior to version 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary JavaScript code execution. This vulnerability affects the v3.x branch and is distinct from CVE-2026-29091.
- CVE-2026-25521High
A prototype pollution vulnerability has been discovered in the Locutus library (versions 2.0.12 through 2.0.38). Despite a previous fix that checked for forbidden keys, an attacker can still pollute Object.prototype via crafted input using String.prototype.
Original NVD description (English source)
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the call_user_func_array function (and its wrapper call_user_func), which fails to properly validate all components of a callback array before passing them to eval(). This issue has been patched in version 3.0.0.