CVE-2026-32304

CriticalCVSS 9.8

Published: 13/03/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.57%

43th percentile - higher than 43% of all known CVEs

Summary

In the Locutus library prior to version 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary JavaScript code execution. This vulnerability affects the v3.x branch and is distinct from CVE-2026-29091.

Risk Assessment

An attacker can exploit this vulnerability to execute arbitrary JavaScript code in the context of the application using Locutus, potentially leading to session hijacking, data theft, or further compromise of the infrastructure.

Recommendation

Immediately update the Locutus library to version 3.0.14 or later. If an update is not possible, avoid using the create_function function with untrusted input.

Original NVD description (English source)

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.