CVE-2026-32304

Description

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.

PUBLISHED Reserved 2026-03-11 | Published 2026-03-12 | Updated 2026-03-13 | Assigner GitHub_M

Problem types

CWE-94: Improper Control of Generation of Code ('Code Injection')

Product status

References

github.com/...ocutus/security/advisories/GHSA-vh9h-29pq-r5m8

github.com/locutusjs/locutus/releases/tag/v3.0.14

cve.org (CVE-2026-32304)

nvd.nist.gov (CVE-2026-32304)

Download JSON