CVE-2026-29091
1 advisory.
npm/locutus CVE-2026-29091: high 8.1, EPSS 1.04%
locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection
Action: Upgrade locutus to 3.0.0 or later.
npm i locutus@3.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.0.0 | - |
Fixed versions
| 3.0.0 |
Sources
- osv: GHSA-fp25-p6mj-qqg6
- https://github.com/locutusjs/locutus/security/advisories/GHSA-fp25-p6mj-qqg6
- https://nvd.nist.gov/vuln/detail/CVE-2026-29091
- https://github.com/locutusjs/locutus/commit/977a1fb169441e35996a1d2465b512322de500ad
- https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval
- https://github.com/locutusjs/locutus
- https://github.com/locutusjs/locutus/blob/main/src/php/funchand/call_user_func_array.js#L31
CVE-2026-29091 · published · modified · JSON