CVE-2026-32304: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32304 is a critical remote code execution (RCE) vulnerability in the Locutus JavaScript library, affecting the create_function() function in v3.x. The function passes both its args and code parameters directly to the JavaScript Function constructor without any sanitization, enabling arbitrary code execution. It affects all Locutus npm package versions up to and including 3.0.13, and was disclosed on March 12, 2026, with a fix released the same day. It carries a CVSS v3.1 base score of 9.8 (Critical) (Github Advisory, Locutus Advisory).

The root cause is in src/php/funchand/create_function.ts at line 17, where the implementation executes return new Function(...params, code) with zero input validation on either parameter (CWE-94: Improper Control of Generation of Code) (Locutus Advisory). An attacker who can control either argument to create_function() — for example, through user-supplied input passed to the function by a vulnerable application — can inject arbitrary JavaScript code that executes in the Node.js process context. This is distinct from the related CVE-2026-29091, which involved call_user_func_array using eval() in Locutus v2.x; this finding specifically targets the new Function() pattern in v3.x. A public proof-of-concept demonstrates execution of OS commands via Node.js's child_process module (Github Advisory).

Successful exploitation grants an attacker full remote code execution in the context of the Node.js process running the vulnerable application, with high impact to confidentiality, integrity, and availability (Locutus Advisory). An attacker can read sensitive data, modify application state, execute OS commands, establish persistence, or pivot laterally within the hosting environment. Given that the package has approximately 597,000 weekly npm downloads, the potential attack surface across dependent applications is significant (Github Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating OS command execution via child_process.execSync() confirmed on Locutus v3.0.11 and Node.js v24.13.1 (Locutus Advisory). The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially exploitable in any application that passes user-controlled input to create_function(). The EPSS score is approximately 0.161% (37th percentile), and there is no confirmed evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (Github Advisory). No threat actor attribution has been reported.

1. Identify vulnerable applications: Search for Node.js applications that depend on locutus versions ≤ 3.0.13 (e.g., via npm list locutus or by inspecting package.json/package-lock.json files in target repositories).
2. Locate user-controlled input paths: Audit the application's code for any call to create_function() from locutus/php/funchand/create_function where either the args or code parameter is derived from user-supplied input (e.g., HTTP request parameters, form fields, API payloads).
3. Craft malicious payload: Prepare a code injection payload for the code argument, such as:

   'return require("child_process").execSync("id").toString()'

4. Deliver payload: Submit the crafted input through the application's exposed interface (e.g., HTTP POST body, query parameter) so it reaches the create_function() call.
5. Achieve code execution: The new Function(...params, code) call in Locutus evaluates the injected code in the Node.js process, returning the output of the OS command or enabling a reverse shell, data exfiltration, or further lateral movement (Locutus Advisory).

• Logs: Application logs showing unexpected output from create_function() calls; Node.js error traces referencing src/php/funchand/create_function with unusual argument values.
• Process: Unexpected child processes spawned by the Node.js application process (e.g., sh, bash, id, whoami, curl, wget) — particularly via child_process.execSync or child_process.exec.
• Network: Unusual outbound connections from the Node.js server process to unknown external IPs or domains, potentially indicating reverse shell or data exfiltration activity.
• File System: New or modified files in the application directory or /tmp created by the Node.js process user, such as web shells, cron jobs, or downloaded binaries.

The primary remediation is to upgrade the locutus npm package to version 3.0.14 or later, which removes php/funchand/create_function entirely (Locutus Release). If immediate patching is not possible, applications should restrict or disable any code paths that pass user-controlled input to create_function(). Developers should audit their codebase for any usage of locutus/php/funchand/create_function and remove or sandbox it. Running Node.js applications with least-privilege OS accounts can limit the blast radius of exploitation (Github Advisory).

The vulnerability was reported by security researcher @ByamB4 and acknowledged by the Locutus maintainer (kvz), who confirmed the issue and released a fix on the same day as disclosure (Locutus Advisory). The maintainer noted that create_function() was deprecated in PHP 7.2 and removed in PHP 8.0, and that the function should not have remained in Locutus given its PHP 8.3 parity target. Red Hat tracked the issue via Bugzilla and classified it as high severity (bugzilla.redhat.com). Social media discussion was observed on Mastodon and Bluesky, with security aggregators and CVE tracking services picking up the advisory shortly after publication.