CVE-2026-29091 Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection
Attackers can execute arbitrary JavaScript code via the call_user_func_array function in the Locutus library due to insecure eval usage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-29091?
CVE-2026-29091 is a high-severity code injection vulnerability in locutusjs locutus, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the call_user_func_array function (and its wrapper call_user_func), which fails to properly validate all components of a callback array before passing them to eval(). This issue has been patched in version 3.0.0.
Which versions are affected by CVE-2026-29091?
2 open source packages ship an affected version, including locutus. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
locutus npm | All versions | 3.0.0 |
locutus npm | All versions | 3.0.0 |
Products include Locutus Locutus.
How do I fix CVE-2026-29091?
Upgrade locutus to 3.0.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-29091 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-29091 exists.
Other vulnerabilities in locutusjs locutus
- CVE-2026-32304 Locutus: RCE via unsanitized input in create_function()
- CVE-2020-7719 Prototype Pollution
- CVE-2026-25521 Locutus is vulnerable to Prototype Pollution
- CVE-2026-33993 Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()
- CVE-2026-33994 Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521
Sources
Also known as GHSA-fp25-p6mj-qqg6.