Junglewise Threat Intelligence

CVE-2026-29091: Locutus remote code execution in call_user_func_array

CVE-2026-29091 · Severity: high · CVSS 8.1 · Published 2026-03-06

Technologies: locutus (npm). Vendors: npm, Red Hat.

Executive brief

Locutus is a library that provides standard functions from other programming languages (like PHP) for use in JavaScript environments. A security flaw was found where the library incorrectly handles certain function calls, allowing an attacker to run unauthorized commands on the server. This could lead to a complete takeover of the affected system, theft of sensitive data, or disruption of services.

Technical details

A code injection vulnerability exists in the 'call_user_func_array' function (and its wrapper 'call_user_func') within the Locutus library. The root cause is an insecure implementation in 'src/php/funchand/call_user_func_array.js' where the second element of a callback array (the method identifier) is concatenated into an eval() string without validation. While the first element (the class/object) is checked against a regex, the second is not, allowing an attacker to escape the property access context and execute arbitrary JavaScript. Exploitation requires the application to pass untrusted user input into these specific callback functions, typically in routing or gateway scenarios. The issue is addressed in version 3.0.0 by refactoring the function to avoid unsafe evaluation.

Affected products

  • locutusjs locutus < 3.0.0
  • Red Hat Logging Subsystem for Red Hat OpenShift 5

Timeline

  • 2026-03-03: patched: Fix committed in version 3.0.0 via TypeScript migration and refactor
  • 2026-03-03: advisory: GitHub Security Advisory GHSA-fp25-p6mj-qqg6 published
  • 2026-03-06: disclosed: CVE-2026-29091 published to NVD

References

Related threats