p PatchFirst

CVE-2026-29091

CVE-2026-29091 · Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the call_user_func_array function (and its wrapper call_user_func), which fails to properly validate all components of a callback array before passing them to eval(). This issue has been patched in version 3.0.0.

CVSS 8.1 · Élevée · EPSS 0,9% · Correctif disponible

Publication
Mise à jour

Pile logicielle: node

Produits et versions concernés

  • locutus

    Versions du logiciel
    • < 3.0.0: Concernée

    Aucun correctif publié

  • locutus npm

    Plages de versions concernées
    • SEMVER: < 3.0.0

    Mettez à jour vers 3.0.0

Sources originales

Vérifiez votre serveur →