Review reviewCritical

CVE-2026-32304

locutusjs locutus, Logging Subsystem for Red Hat OpenShift

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.

CVSS: 9.8
EPSS: 0.56%
CISA KEV: Not listed
Published: 2026.03.14

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.56%

Technical severityCVSS 9.8

Vulnerability overview

Affected product and versions

Product: locutusjs locutus, Logging Subsystem for Red Hat OpenShift
Affected versions: >= < 3.0.14, < 3.0.14
Fixed versions: 3.0.14

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that locutusjs locutus, Logging Subsystem for Red Hat OpenShift and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-88, CWE-94