p PatchFirst

CVE-2026-29091

CVE-2026-29091 · Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the call_user_func_array function (and its wrapper call_user_func), which fails to properly validate all components of a callback array before passing them to eval(). This issue has been patched in version 3.0.0.

CVSS 8.1 · Alta · EPSS 0,9% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • locutus

    Versiones
    • < 3.0.0: Afectada

    Sin corrección publicada

  • locutus npm

    Intervalos de versiones afectados
    • SEMVER: < 3.0.0

    Actualiza a 3.0.0

Fuentes originales

Comprueba tu servidor →