CVE-2026-32304
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.
- Affected products
- Logging Subsystem For Red Hat Openshift, Locutus
- Locutus
- < 3.0.14
- Fix
- Available
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 0.6% (44th percentile)
- Weakness
- CWE-88, CWE-94
- NVD status
- Modified
- Published
- 2026-03-12
CVE-2026-32304 at NVD
No indexed exploits for CVE-2026-32304 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-32304 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.