https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T16:16:51.336993+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-337366 EUVD-2026-337366 2026-10-06T16:16:51.377368+00:00 EUVD-2026-337366 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29091 fkie_cve-2026-29091 2026-10-06T16:16:51.377412+00:00

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the call_user_func_array function (and its wrapper call_user_func), which fails to properly validate all components of a callback array before passing them to eval(). This issue has been patched in version 3.0.0.

 https://cve.radiocsirt.org/vuln/ghsa-fp25-p6mj-qqg6 GHSA-fp25-p6mj-qqg6 — locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection 2026-10-06T16:16:51.377453+00:00

Affected: npm: locutus

### Details

A Remote Code Execution (RCE) flaw was discovered in the `locutus` project (v2.0.39), specifically within the `call_user_func_array` function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the `call_user_func_array` function (and its wrapper `call_user_func`), which fails to properly validate all components of a callback array before passing them to `eval()`.

------

### Technical Details

The vulnerability is in the `call_user_func_array` function in `src/php/funchand/call_user_func_array.js`, between lines 31 and 35 of version 2.0.39. This function mimics PHP's dynamic function call feature and accepts a callback argument, which can be a string (function name) or an array (class and method name).

The developers applied a regular expression check (`validJSFunctionNamePattern`) to the first array element (the class identifier), but not to the second element (the method identifier). As a result, the code inserts the user-supplied method name directly into the evaluation string: `func = eval(cb[0] + "['" + cb[1] + "']")`. This oversight allows an attacker to craft a payload in the second element that escapes the property access context, injects arbitrary JavaScript commands, and executes them with the full privileges of the Node.js process.

``````javascript // src/php/funchand/call_user_func_array.js (Lines 31-35)

if (cb[0].…