https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 18:56:10 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-337366 EUVD-2026-337366 https://cve.radiocsirt.org/vuln/euvd-2026-337366 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29091 <p>Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application&#39;s runtime environment. This issue stems from an insecure implementation of the call_user_func_array function (and its wrapper call_user_func), which fails to properly validate all components of a callback array before passing them to eval(). This issue has been patched in version 3.0.0.</p> <p>Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application&#39;s runtime environment. This issue stems from an insecure implementation of the call_user_func_array function (and its wrapper call_user_func), which fails to properly validate all components of a callback array before passing them to eval(). This issue has been patched in version 3.0.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-29091 https://cve.radiocsirt.org/vuln/ghsa-fp25-p6mj-qqg6 <p><strong>Affected:</strong> npm: locutus</p> <p>### Details</p> <p>A Remote Code Execution (RCE) flaw was discovered in the `locutus` project (v2.0.39), specifically within the `call_user_func_array` function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application&#39;s runtime environment. This issue stems from an insecure implementation of the `call_user_func_array` function (and its wrapper `call_user_func`), which fails to properly validate all components of a callback array before passing them to `eval()`.</p> <p>------</p> <p>### Technical Details</p> <p>The vulnerability is in the `call_user_func_array` function in `src/php/funchand/call_user_func_array.js`, between lines 31 and 35 of version 2.0.39. This function mimics PHP&#39;s dynamic function call feature and accepts a callback argument, which can be a string (function name) or an array (class and method name).</p> <p>The developers applied a regular expression check (`validJSFunctionNamePattern`) to the first array element (the class identifier), but not to the second element (the method identifier). As a result, the code inserts the user-supplied method name directly into the evaluation string: `func = eval(cb[0] + &#34;[&#39;&#34; + cb[1] + &#34;&#39;]&#34;)`. This oversight allows an attacker to craft a payload in the second element that escapes the property access context, injects arbitrary JavaScript commands, and executes them with the full privileges of the Node.js process.</p> <p>``````javascript // src/php/funchand/call_user_func_array.js (Lines 31-35)</p> <p>if (cb[0].…</p> <p><strong>Affected:</strong> npm: locutus</p> <p>### Details</p> <p>A Remote Code Execution (RCE) flaw was discovered in the `locutus` project (v2.0.39), specifically within the `call_user_func_array` function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application&#39;s runtime environment. This issue stems from an insecure implementation of the `call_user_func_array` function (and its wrapper `call_user_func`), which fails to properly validate all components of a callback array before passing them to `eval()`.</p> <p>------</p> <p>### Technical Details</p> <p>The vulnerability is in the `call_user_func_array` function in `src/php/funchand/call_user_func_array.js`, between lines 31 and 35 of version 2.0.39. This function mimics PHP&#39;s dynamic function call feature and accepts a callback argument, which can be a string (function name) or an array (class and method name).</p> <p>The developers applied a regular expression check (`validJSFunctionNamePattern`) to the first array element (the class identifier), but not to the second element (the method identifier). As a result, the code inserts the user-supplied method name directly into the evaluation string: `func = eval(cb[0] + &#34;[&#39;&#34; + cb[1] + &#34;&#39;]&#34;)`. This oversight allows an attacker to craft a payload in the second element that escapes the property access context, injects arbitrary JavaScript commands, and executes them with the full privileges of the Node.js process.</p> <p>``````javascript // src/php/funchand/call_user_func_array.js (Lines 31-35)</p> <p>if (cb[0].…</p> https://cve.radiocsirt.org/vuln/ghsa-fp25-p6mj-qqg6