CVE-2026-32304

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/locutusjs/locutus/releases/tag/v3.0.14	Product Release Notes
https://github.com/locutusjs/locutus/security/advisories/GHSA-vh9h-29pq-r5m8	Exploit Mitigation Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:locutus:locutus:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2026-03-13 19:54

Updated : 2026-03-19 13:48

NVD link : CVE-2026-32304

Mitre link : CVE-2026-32304

CVE.ORG link : CVE-2026-32304

JSON object : View

Products Affected

locutus

locutus

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-32304", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2026-03-13T19:54:41.830", "references": [{"url": "https://github.com/locutusjs/locutus/releases/tag/v3.0.14", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/locutusjs/locutus/security/advisories/GHSA-vh9h-29pq-r5m8", "tags": ["Exploit", "Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14."}, {"lang": "es", "value": "Locutus trae bibliotecas est\u00e1ndar de otros lenguajes de programaci\u00f3n a JavaScript con fines educativos. Antes de la versi\u00f3n 3.0.14, la funci\u00f3n create_function(args, code) pasa ambos par\u00e1metros directamente al constructor Function sin ninguna sanitizaci\u00f3n, permitiendo la ejecuci\u00f3n de c\u00f3digo arbitrario. Esto es distinto de CVE-2026-29091, que era call_user_func_array usando eval() en v2.x. Este hallazgo afecta a create_function usando new Function() en v3.x. Esta vulnerabilidad est\u00e1 corregida en 3.0.14."}], "lastModified": "2026-03-19T13:48:33.690", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:locutus:locutus:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "96DC0599-8FE6-45BD-AE3C-A76DE784C161", "versionEndExcluding": "3.0.14"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}