CVE-2026-32304 - Vulnerability Analysis

Overview

Locutus < 3.0.14 contains a remote code execution caused by unsanitized parameters passed to the Function constructor in create_function, letting attackers execute arbitrary code remotely, exploit requires crafted input.

Severity & Score

Impact

Attackers can execute arbitrary code remotely, potentially compromising the system.

Mitigation

Upgrade to version 3.0.14 or later.

References

• https://github.com/locutusjs/locutus/releases/tag/v3.0.14
• https://github.com/locutusjs/locutus/security/advisories/GHSA-vh9h-29pq-r5m8

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 13, 2026

🔴 CVE-2026-32304 - Critical (9.8) Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32304/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner