CVE-2026-32304: Locutus Package Vulnerable to RCE via Unsanitized Input in create_function()
Summary
CVE-2026-32304: Locutus vulnerable to RCE via unsanitized input in create_function(). Affects locutus versions < 3.0.14. Fixed in 3.0.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Locutus is a JavaScript library that provides PHP functions for Node.js environments, allowing developers to use PHP-like syntax in their JavaScript applications. It aims to bridge the gap between PHP and JavaScript, enabling easier migration of PHP code to JavaScript. However, a critical vulnerability has been identified in the 'create_function()' method, which can lead to remote code execution (RCE) when unsanitized input is processed.
Vulnerability Detail
The vulnerability arises from the 'create_function(args, code)' function, which directly passes its parameters to the 'Function' constructor without any input validation. This oversight allows an attacker to execute arbitrary code by controlling either the 'args' or 'code' parameters. The issue is particularly severe as it can lead to full remote code execution, impacting systems that utilize this function. The vulnerability has been confirmed in Locutus version 3.0.11 and can be exploited using a simple JavaScript snippet that executes system commands.
How To Fix
Latest published version: 3.0.36 as of 23 Oct 2026
npm install locutus@3.0.36Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.14
This is the first release that contains the fix.
npm install locutus@3.0.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, avoid using the 'create_function()' method in your code. If you need similar functionality, consider implementing a safe alternative that does not rely on dynamic code execution. For example, you can use predefined functions or closures instead of creating functions dynamically.
Conclusion
The CVE-2026-32304 vulnerability in the Locutus package poses a significant risk due to its potential for remote code execution. It is crucial for developers using this library to update to the patched version 3.0.14 to mitigate the risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in open-source software effectively.
See every vulnerability recorded for locutus →
FAQ
The CVE-2026-32304 vulnerability has a CVSS score of 9.8, indicating a critical level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application without any signup using the Vulert playground at Vulert Scanner.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to execute arbitrary commands on the server, potentially compromising the entire system.
Yes, instead of using 'create_function()', consider using predefined functions or closures that do not involve dynamic code execution.
Versions of Locutus up to and including 3.0.13 are affected by this vulnerability. The issue has been fixed in version 3.0.14.
References
Related vulnerabilities
Recent vulnerabilities recorded for locutus.
