Locutus vulnerabilities

In the Locutus library prior to version 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary JavaScript code execution. This vulnerability affects the v3.x branch and is distinct from CVE-2026-29091.

A remote code execution (RCE) vulnerability was discovered in the Locutus project, which ports standard libraries from other programming languages to JavaScript. The flaw affects the call_user_func_array function and its wrapper call_user_func, which fail to properly validate callback array components before passing them to eval().

A prototype pollution vulnerability has been discovered in the Locutus library (versions 2.0.12 through 2.0.38). Despite a previous fix that checked for forbidden keys, an attacker can still pollute Object.prototype via crafted input using String.prototype.