What is the CVSS score of CVE-2026-29091?

CVE-2026-29091 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Locutus are affected by CVE-2026-29091?

A critical remote code execution vulnerability exists in the Locutus JavaScript library (CVE-2026-29091) that could allow attackers to execute arbitrary code within applications using affected…. A patch is available.

How to fix or mitigate CVE-2026-29091?

Within 24 hours: Inventory all applications and dependencies using Locutus library and isolate affected systems from production traffic where possible. Within 7 days: Implement network-based compensating controls (WAF rules, input validation), disable call_user_func_array functionality if not critical, and establish enhanced monitoring for suspicious code execution patterns. Within 30 days: Transition to alternative libraries, evaluate vendor patch release timelines, and conduct code review of any Locutus implementations handling untrusted input.

Locutus CVE-2026-29091

HIGH

Eval Injection (CWE-95)

2026-03-06 security-advisories@github.com

GHSA-fp25-p6mj-qqg6

RCE Code Injection Locutus

8.1

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 18:16 nvd

HIGH 8.1

DescriptionCVE.org

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the call_user_func_array function (and its wrapper call_user_func), which fails to properly validate all components of a callback array before passing them to eval(). This issue has been patched in version 3.0.0.

AnalysisAI

Remote code execution in Locutus prior to version 3.0.0 allows unauthenticated remote attackers to execute arbitrary JavaScript code through improper validation in the call_user_func_array function, which unsafely passes user-controlled callback parameters to eval(). Applications using the vulnerable versions of this JavaScript standard library implementation are at risk of complete compromise through network-based attacks. No patch is currently available for affected deployments.

Technical ContextAI

This vulnerability (CWE-95: Eval Injection) exists in the call_user_func_array component. Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the call_user_func_array function (and its wrapper call_user_func), w