Junglewise Threat Intelligence

CVE-2026-32304: Locutus code injection in create_function

CVE-2026-32304 · Severity: critical · CVSS 9.8 · Published 2026-03-13

Technologies: Locutusjs Locutus. Vendors: npm, Red Hat.

Executive brief

Locutus is a library that provides standard library functions from other programming languages for use in JavaScript. A vulnerability in its PHP-style function creation tool allows attackers to execute unauthorized commands on the underlying system. This could lead to a complete takeover of the application or server running the library. Users should update to the latest version where the dangerous function has been removed.

Technical details

A code injection vulnerability exists in the 'create_function' implementation within Locutus v3.x. The root cause is the lack of sanitization for the 'args' and 'code' parameters, which are passed directly to the JavaScript 'Function' constructor. An attacker who can control these inputs can achieve remote code execution (RCE) in the context of the Node.js process. This issue is distinct from previous vulnerabilities that used 'eval()'. The vulnerability was addressed in version 3.0.14 by removing the 'create_function' utility entirely to align with PHP 8.3 parity, where the function was deprecated and removed for similar security concerns.

Affected products

  • locutusjs locutus < 3.0.14
  • Red Hat Logging Subsystem for Red Hat OpenShift 5

Timeline

  • 2026-03-11: patched: Version 3.0.14 released on GitHub
  • 2026-03-12: advisory: GitHub Security Advisory published
  • 2026-03-13: disclosed: CVE published to NVD

References

Related threats