CVE-2026-29091 - Vulnerability Analysis

Overview

Locutus < 3.0.0 contains a remote code execution caused by improper validation in call_user_func_array function, letting remote attackers inject arbitrary JavaScript code, exploit requires crafted callback input.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript code remotely, potentially leading to full system compromise.

Mitigation

Update to version 3.0.0 or later.

References

• https://github.com/locutusjs/locutus/commit/977a1fb169441e35996a1d2465b512322de500ad
• https://github.com/locutusjs/locutus/security/advisories/GHSA-fp25-p6mj-qqg6

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 7, 2026

🟠 CVE-2026-29091 - High (8.1) Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function i... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29091/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner