CVE-2026-32304: Locutus RCE Vulnerability

CVE-2026-32304 Overview

CVE-2026-32304 is a critical code injection vulnerability affecting Locutus, a JavaScript library that ports standard library functions from other programming languages (such as PHP) to JavaScript for educational purposes. The vulnerability exists in the create_function(args, code) function, which passes both parameters directly to the JavaScript Function constructor without any sanitization. This allows attackers to execute arbitrary code within the application context.

Critical Impact

This vulnerability enables remote attackers to achieve arbitrary code execution by crafting malicious input to the create_function() function, potentially leading to complete system compromise.

Affected Products

• Locutus versions prior to 3.0.14 (Node.js package)
• Applications using the create_function() function from vulnerable Locutus versions
• Node.js environments running affected Locutus library versions

Discovery Timeline

• 2026-03-13 - CVE-2026-32304 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-32304

Vulnerability Analysis

This vulnerability stems from improper input validation in Locutus's implementation of PHP's create_function() function. The affected code accepts two parameters—function arguments and function body—and passes them directly to JavaScript's native Function constructor without any form of sanitization or validation.

The Function constructor in JavaScript is functionally equivalent to eval() in terms of security implications, as it dynamically creates and executes code from string inputs. When user-controlled data reaches this constructor without proper sanitization, attackers can inject arbitrary JavaScript code that will be executed in the application's context.

This vulnerability is distinct from CVE-2026-29091, which affected the call_user_func_array function using eval() in Locutus v2.x. CVE-2026-32304 specifically affects the create_function implementation using new Function() in v3.x releases.

Root Cause

The root cause of CVE-2026-32304 is the absence of input sanitization before passing user-controlled parameters to the JavaScript Function constructor. The create_function(args, code) implementation directly constructs a new function using the provided arguments without validating or escaping potentially malicious content. This design flaw allows code injection attacks where attacker-controlled strings are interpreted and executed as JavaScript code.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by providing malicious strings as parameters to the create_function() function. If an application exposes this function to user input—such as through API endpoints, form submissions, or other data processing pipelines—an attacker can inject arbitrary JavaScript code.

The malicious code executes with the same privileges as the Node.js application, potentially enabling attackers to read sensitive files, modify data, establish persistence, or pivot to other systems in the network.

Detection Methods for CVE-2026-32304

Indicators of Compromise

• Unusual function creation patterns in application logs involving create_function() calls
• Unexpected outbound network connections from Node.js processes
• Anomalous process spawning or file system modifications originating from the application
• Error logs showing syntax errors in dynamically generated function code

Detection Strategies

• Implement static code analysis to identify uses of create_function() with user-controlled input
• Deploy runtime application self-protection (RASP) to monitor dynamic function creation
• Use dependency scanning tools to identify Locutus versions prior to 3.0.14 in your projects
• Monitor for npm audit warnings related to the Locutus package

Monitoring Recommendations

• Enable detailed logging for all create_function() invocations including parameter values
• Implement network monitoring to detect unusual egress traffic from Node.js applications
• Set up alerts for package.json changes that introduce or downgrade Locutus dependencies
• Configure application performance monitoring to detect unexpected code execution patterns

How to Mitigate CVE-2026-32304

Immediate Actions Required

• Upgrade Locutus to version 3.0.14 or later immediately
• Audit application code for any usage of create_function() with user-supplied input
• Implement input validation and sanitization as a defense-in-depth measure
• Consider removing or replacing usage of create_function() with safer alternatives

Patch Information

The vulnerability has been addressed in Locutus version 3.0.14. Organizations should update their package dependencies immediately. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-vh9h-29pq-r5m8 and the Locutus v3.0.14 release notes.

Workarounds

• Avoid using the create_function() function entirely until patched versions are deployed
• Implement strict input validation on any data that may reach dynamic function creation
• Use Content Security Policy (CSP) headers where applicable to restrict script execution
• Isolate Node.js applications using vulnerable versions in sandboxed environments

# Update Locutus to the patched version
npm update locutus@3.0.14

# Verify the installed version
npm list locutus

# Alternatively, update package.json to require minimum safe version
# "locutus": ">=3.0.14"