9.8
Critique
CVE-2026-32304 Locutus brings stdlibs of other programming languages to JavaScript for educational purposes
Description
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Versions non publiées | |
| locutus 3.0 | premières → < 3.0.14 | 3.0.14 |
Références
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Logging Subsystem for Red Hat OpenShift
Les 78 CVE de Logging Subsystem for Red Hat OpenShift →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Moyenne
CVE-2026-92925
Redis: redis: out-of-bounds read via crafted cluster bus packets
7.1
Élevée
CVE-2026-16242
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes
9.4
Critique
CVE-2026-10609
A missing authorization flaw was found in the OpenShift Cluster Logging Operator
6.8
Moyenne