9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32304

CVE-2026-32304: Locutus: RCE via unsanitized input in create_function()

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32304

CVE-2026-32304:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
locutus	npm	<= 3.0.13	3.0.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the create_function in locutus directly uses the new Function() constructor with unsanitized user input, which is a well-known vector for code injection. The analysis of the patch commit 412fdb17b9b0138023eae0b32d2519ee6c547661 confirms this. The patch completely removes the create_function from the codebase, which is the most effective way to fix this vulnerability. Additionally, the var_export function was identified as a vector that could be used to trigger the vulnerability in create_function. The patch modifies var_export to no longer generate calls to the removed create_function, thus closing that attack vector as well. Both functions are therefore included in the list of vulnerable functions.

Vulnerable functions

create_function

src/php/funchand/create_function.ts

The `create_function` function is directly vulnerable as it uses `new Function()` with user-provided `args` and `code` without any sanitization. This allows for the execution of arbitrary JavaScript code, leading to Remote Code Execution (RCE). The patch addresses this by completely removing the function.

var_export

src/php/var/var_export.ts

The `var_export` function was vulnerable because when it encountered a function as input, it would generate a string containing a call to the insecure `create_function`. An attacker could control the input to `var_export` to craft a malicious function, which would then be passed to `create_function`, leading to RCE. The patch mitigates this by changing the export format for closures to avoid calling `create_function`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.