Is CVE-2026-29091 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-29091 being exploited in the wild.

How severe is CVE-2026-29091?

High severity, with a CVSS score of 8.1, published 6 March 2026.

Which products and versions are affected?

locutus (npm) SEMVER:introduced=0,fixed=3.0.0.

Is there a fix for CVE-2026-29091?

Yes. locutus (npm): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-29091 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-29091?

Check whether you run locutus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29091: Locutus remote code execution in call_user_func_array

CVE-2026-29091 · Severity: high · CVSS 8.1 · Published 2026-03-06

Locutus is a library that provides standard functions from other programming languages (like PHP) for use in JavaScript environments. A security flaw was found where the library incorrectly handles certain function calls, allowing an attacker to run unauthorized commands on the server. This could lead to a complete takeover of the affected system, theft of sensitive data, or disruption of services.

Technologies: locutus (npm). Vendors: npm.

Quick answers

Is CVE-2026-29091 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-29091 being exploited in the wild.
How severe is CVE-2026-29091?: High severity, with a CVSS score of 8.1, published 6 March 2026.
Which products and versions are affected?: locutus (npm) SEMVER:introduced=0,fixed=3.0.0.
Is there a fix for CVE-2026-29091?: Yes. locutus (npm): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-29091 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-29091?: Check whether you run locutus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

locutus (npm): upgrade to 3.0.0 or later
```
npm install locutus@3.0.0
```

Technical details

A code injection vulnerability exists in the 'call_user_func_array' function (and its wrapper 'call_user_func') within the Locutus library. The root cause is an insecure implementation in 'src/php/funchand/call_user_func_array.js' where the second element of a callback array (the method identifier) is concatenated into an eval() string without validation. While the first element (the class/object) is checked against a regex, the second is not, allowing an attacker to escape the property access context and execute arbitrary JavaScript. Exploitation requires the application to pass untrusted user input into these specific callback functions, typically in routing or gateway scenarios. The issue is addressed in version 3.0.0 by refactoring the function to avoid unsafe evaluation.

Affected products

locutusjs locutus < 3.0.0
Red Hat Logging Subsystem for Red Hat OpenShift 5

Identifiers

CVE-2026-29091
GHSA-fp25-p6mj-qqg6

Timeline

2026-03-03: patched: Fix committed in version 3.0.0 via TypeScript migration and refactor
2026-03-03: advisory: GitHub Security Advisory GHSA-fp25-p6mj-qqg6 published
2026-03-06: disclosed: CVE-2026-29091 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.