CVE-2026-32304
Critical · 9.8CVSS
9.8
EPSS
0.9%
Published
Mar 13, 2026
CISA due date
—
The record
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | locutus | 0 | 3.0.14 |
Related vulnerabilities
- GHSA-vh9h-29pq-r5m8 Locutus vulnerable to RCE via unsanitized input in create_function() Same vulnerability
- CVE-2026-33994 Locutus brings stdlibs of other programming languages to JavaScript for educational… Also affects locutus
- CVE-2026-33993 Locutus brings stdlibs of other programming languages to JavaScript for educational… Also affects locutus
- GHSA-vc8f-x9pp-wf5p Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521 Also affects locutus
- GHSA-4mph-v827-f877 Locutus has Prototype Pollution via __proto__ Key Injection in unserialize() Also affects locutus
- CVE-2026-29091 Locutus brings stdlibs of other programming languages to JavaScript for educational… Also affects locutus
- GHSA-fp25-p6mj-qqg6 locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code… Also affects locutus
- CVE-2026-25521 Locutus brings stdlibs of other programming languages to JavaScript for educational… Also affects locutus