CVE-2026-32304: Locutus Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vh9h-29pq-r5m8",
  "modified" : "2026-03-16T17:06:41Z",
  "published" : "2026-03-13T16:10:29Z",
  "aliases" : [ "CVE-2026-32304" ],
  "summary" : "Locutus vulnerable to RCE via unsanitized input in create_function()",
  "details" : "## Summary\n\nThe `create_function(args, code)` function passes both parameters directly to the `Function` constructor without any sanitization, allowing arbitrary code execution.\n\nThis is distinct from CVE-2026-29091 (GHSA-fp25-p6mj-qqg6) which was `call_user_func_array` using `eval()` in v2.x. This finding affects `create_function` using `new Function()` in v3.x.\n\n## Root Cause\n\n`src/php/funchand/create_function.ts:17`:\n```typescript\nreturn new Function(...params, code)\n```\n\nZero input validation on either parameter.\n\n## PoC\n\n```javascript\nconst { create_function } = require('locutus/php/funchand/create_function');\nconst rce = create_function('', 'return require(\"child_process\").execSync(\"id\").toString()');\nconsole.log(rce());\n// Output: uid=501(user) gid=20(staff) ...\n```\n\nConfirmed on locutus v3.0.11, Node.js v24.13.1.\n\n## Impact\n\nFull RCE when an attacker can control either argument to `create_function()`. 597K weekly npm downloads.\n\n## Suggested Fix\n\nRemove `create_function` or replace `new Function()` with a safe alternative. PHP itself deprecated `create_function()` in PHP 7.2 for the same reason.\n\n## Response\n\nThanks for the report.\n\nWe confirmed that `php/funchand/create_function` was still present through `locutus@3.0.13` and that it exposed dynamic code execution via `new Function(...)`.\n\nWhile this was intended behavior, `create_function()` inherently needs to be unsafe in order for it to work, `create_function()` was deprecated in PHP 7.2 and removed in PHP 8.0. Given that Locutus' parity target today is 8.3, this function shouldn't have been in Locutus at all anymore.\n\nWe fixed this in `locutus@3.0.14` by removing `php/funchand/create_function` entirely. That matches our PHP 8.3 parity target more closely: . \n\nWe also updated `php/var/var_export` so closures now export using the PHP 8-style `\\Closure::__set_state(array(...))` form instead of referencing the removed API.\n\nRelease:\n- npm: `locutus@3.0.14`\n- GitHub release: https://github.com/locutusjs/locutus/releases/tag/v3.0.14\n\nCredit to @ByamB4 for the report.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "locutus"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.0.14"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.0.13"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/locutusjs/locutus/security/advisories/GHSA-vh9h-29pq-r5m8"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-32304"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/locutusjs/locutus"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/locutusjs/locutus/releases/tag/v3.0.14"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-94" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-13T16:10:29Z",
    "nvd_published_at" : "2026-03-13T19:54:41Z"
  }
}