CVE-2026-32304 Locutus: RCE via unsanitized input in create_function()
Attackers can execute arbitrary code via unsanitized input in the create_function method of the Locutus JavaScript library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32304?
CVE-2026-32304 is a critical code injection vulnerability in locutusjs locutus, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.
Which versions are affected by CVE-2026-32304?
2 open source packages ship an affected version, including locutus. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
locutus npm | All versions | 3.0.14 |
locutus npm | All versions | 3.0.14 |
Products include Locutus Locutus.
How do I fix CVE-2026-32304?
Upgrade locutus to 3.0.14 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-32304 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32304 exists.
Other vulnerabilities in locutusjs locutus
- CVE-2020-7719 Prototype Pollution
- CVE-2026-25521 Locutus is vulnerable to Prototype Pollution
- CVE-2026-29091 Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection
- CVE-2026-33993 Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()
- CVE-2026-33994 Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521
Sources
Also known as GHSA-vh9h-29pq-r5m8.