CVE-2026-32304

Katalog CVE

CVSS 9.8 · Critical EPSS 0,86%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada locutus. Skor CVSS 3.1 9.8 (Critical) menurut github.com.

Deskripsi (NVD)

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.

Rincian

Terbit di NVD

13 Maret 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

0,86% peluang dieksploitasi; lebih tinggi dari 57,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/locutusjs/locutus/security/advisories/GHSA-vh9h-29pq-r5m8 exploit · mitigasi · patch · advisory vendor
• https://github.com/locutusjs/locutus/releases/tag/v3.0.14 product · release notes
• https://access.redhat.com/security/cve/CVE-2026-32304
• https://bugzilla.redhat.com/show_bug.cgi?id=2447200
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32304.json