CVE-2026-29091: 
JavaScript vulnerability analysis and mitigation

CVE-2026-29091 is a Remote Code Execution (RCE) vulnerability in the Locutus npm library (versions ≤ 2.0.39) caused by eval injection in the call_user_func_array function. Discovered by researcher Tomas Illuminati and disclosed on March 3, 2026 via GitHub Advisory GHSA-fp25-p6mj-qqg6, it was published to the NVD on March 6, 2026. The vulnerability affects all Locutus versions up to and including 2.0.39 for Node.js, with version 3.0.0 containing the fix. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory).

The root cause is CWE-95 (Eval Injection): the call_user_func_array function in src/php/funchand/call_user_func_array.js (lines 31–35 of v2.0.39) applies a regex validation (validJSFunctionNamePattern) only to the first callback array element (cb[0], the class identifier) but passes the second element (cb[1], the method identifier) unsanitized directly into an eval() call: func = eval(cb[0] + "['" + cb[1] + "']"). An attacker who controls cb[1] can craft a payload that escapes the property access context and injects arbitrary JavaScript commands executed with full Node.js process privileges. This flaw is exploitable in applications that act as gateways or routers passing untrusted array callbacks to call_user_func_array(), a pattern common in JSON-RPC setups and PHP-to-JavaScript porting layers (GitHub Advisory, Locutus Security Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript code within the Node.js process, resulting in high impact to confidentiality, integrity, and availability. An attacker can read sensitive data, modify application state, execute system commands (e.g., via child_process.execSync), or disrupt service availability — all with the privileges of the running Node.js process. The vulnerability is not a drive-by flaw; it only manifests in applications that serve as gateways or routers using Locutus functions and that pass untrusted input to call_user_func_array(), but within those deployments the impact is complete system compromise (GitHub Advisory).

A public proof-of-concept (PoC) is included in the GitHub Security Advisory itself, demonstrating exploitation by passing a crafted cb[1] payload (e.g., ']; require('child_process').execSync('id').toString().trim(); //) to call_user_func_array. The advisory notes the flaw has been exploited in practice in gateway/router deployments. The EPSS score is approximately 0.506% (67th percentile), and the Feedly data lists an EPSS of 0.00333. There is no current CISA KEV catalog listing, and no specific threat actor attribution has been reported (GitHub Advisory, Locutus Security Advisory).

1. Identify vulnerable deployments: Locate Node.js applications using the locutus npm package at version ≤ 2.0.39 that expose an endpoint accepting user-controlled callback arrays (e.g., JSON-RPC APIs or PHP-to-JS porting layers).
2. Craft the malicious payload: Construct a callback array where cb[0] is a valid JavaScript identifier (e.g., "Date") to pass the regex check, and cb[1] contains the injection payload: "']; require('child_process').execSync('id').toString().trim(); //".
3. Deliver the payload: Send the crafted callback array to the vulnerable application endpoint that passes untrusted input to call_user_func_array(). In a JSON-RPC context, this may be via a POST request with a JSON body containing the malicious callback.
4. Trigger eval injection: The vulnerable code evaluates eval("Date" + "['" + payload + "']"), which breaks out of the property access context and executes the injected child_process.execSync call.
5. Achieve code execution: The injected command runs with the full privileges of the Node.js process. Output may surface in error messages (as shown in the PoC), enabling data exfiltration, reverse shell establishment, or further lateral movement (GitHub Advisory, Locutus Security Advisory).

• Network: Unusual or malformed JSON-RPC requests containing array callback parameters with special characters ('];, require(, child_process) in the method name field; unexpected outbound connections from the Node.js process to external hosts.
• Logs: Application error logs containing output of system commands (e.g., strings matching uid=, gid=) embedded in error messages such as "X is not a valid function"; repeated failed or anomalous calls to call_user_func_array with array-type callbacks.
• Process: Unexpected child processes spawned by the Node.js application (e.g., sh, bash, id, curl, wget); use of child_process module in contexts not expected by the application.
• File System: New or modified files in the application directory created by the Node.js process user; unexpected scripts or web shells dropped in writable directories.

Upgrade the locutus npm package to version 3.0.0 or later, which resolves the vulnerability by refactoring call_user_func_array to resolve objects via safe property access (obj[cb[1]]) rather than string concatenation into eval(). The fix was committed in locutusjs/locutus@977a1fb. As an interim workaround, applications should validate and sanitize all callback array elements before passing them to call_user_func_array(), and avoid exposing endpoints that accept untrusted callback arrays. Restricting network access to vulnerable endpoints and auditing code for gateway/router patterns using Locutus functions is also recommended (GitHub Advisory, Locutus Security Advisory).

The vulnerability was reported by researcher Tomas Illuminati and published by Locutus maintainer kvz on March 3, 2026. Coverage appeared on Mastodon via @thehackerwire and on Bluesky, with aggregation by vulnerability tracking services including Vulners, CVEFeed, and VulDB. A technical write-up was published by Infinitsec covering the RCE mechanics. Community reaction noted the nuanced nature of the flaw — it is a library supplier defect rather than a misuse issue, as the library's own protection for cb[0] makes cb[1] injection the only viable bypass path (GitHub Advisory, Infinitsec).