CVE-2026-29091

Katalog CVE

CVSS 8.1 · High EPSS 1,0%

Kerentanan Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') pada locutus. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the call_user_func_array function (and its wrapper call_user_func), which fails to properly validate all components of a callback array before passing them to eval(). This issue has been patched in version 3.0.0.

Rincian

Terbit di NVD

6 Maret 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/locutusjs/locutus/security/advisories/GHSA-fp25-p6mj-qqg6 exploit · mitigasi · advisory vendor
• https://github.com/locutusjs/locutus/commit/977a1fb169441e35996a1d2465b512322de500ad patch
• https://access.redhat.com/security/cve/CVE-2026-29091
• https://bugzilla.redhat.com/show_bug.cgi?id=2445262
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29091.json