9.8
Critical
CVE-2026-32304 Locutus brings stdlibs of other programming languages to JavaScript for educational purposes
Description
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Versions not published | |
| locutus 3.0 | earliest → < 3.0.14 | 3.0.14 |
References
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Logging Subsystem for Red Hat OpenShift
The 78 CVEs of Logging Subsystem for Red Hat OpenShift →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Medium
CVE-2026-92925
Redis: redis: out-of-bounds read via crafted cluster bus packets
7.1
High
CVE-2026-16242
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes
9.4
Critical
CVE-2026-10609
A missing authorization flaw was found in the OpenShift Cluster Logging Operator
6.8
Medium