CVE-2026-32304criticalCWE-88CWE-94

CVE-2026-32304: falha crítica em locutusjs locutus

Locutus: RCE via unsanitized input in create_function()

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar locutus+ Monitorar locutus

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.6%
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
locutusjs · locutus
CVEs relacionadas — locutusjs locutus

No mesmo produto, das mais perigosas para as menos.

CVE-2026-29091HIGHLocutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code InjectionEPSS 0.9%CVE-2026-33993MEDIUMLocutus has Prototype Pollution via __proto__ Key Injection in unserialize()EPSS 0.6%CVE-2026-33994MEDIUMLocutus Prototype Pollution due to incomplete fix for CVE-2026-25521EPSS 0.6%CVE-2026-25521CRITICALLocutus is vulnerable to Prototype PollutionEPSS 0.3%