CVE-2026-32304
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
In the Locutus library prior to version 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary JavaScript code execution. This vulnerability affects the v3.x branch and is distinct from CVE-2026-29091.
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary JavaScript code in the context of the application using Locutus, potentially leading to session hijacking, data theft, or further compromise of the infrastructure.
Recommendation
Immediately update the Locutus library to version 3.0.14 or later. If an update is not possible, avoid using the create_function function with untrusted input.
Other vulnerabilities in Locutus
See all- CVE-2026-29091High
A remote code execution (RCE) vulnerability was discovered in the Locutus project, which ports standard libraries from other programming languages to JavaScript. The flaw affects the call_user_func_array function and its wrapper call_user_func, which fail to properly validate callback array components before passing them to eval().
- CVE-2026-25521High
A prototype pollution vulnerability has been discovered in the Locutus library (versions 2.0.12 through 2.0.38). Despite a previous fix that checked for forbidden keys, an attacker can still pollute Object.prototype via crafted input using String.prototype.
Original NVD description (English source)
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS