The bug lies in the implementation of call_user_func_array (and its alias call_user_func), which naively forwards parts of a callback array to eval() after failing to validate them fully. This omission permits an attacker to provide crafted JavaScript code that is executed with the privileges of the running application, leading to remote code execution. The weakness is categorized as CWE-94 (Code Injection) and CWE-95 (Eval Injection).

The issue affects the open‑source library locutus, which exposes standard libraries of other languages to JavaScript. Versions older than 3.0.0 contain the vulnerable implementation. The library is typically used in Node.js environments, but can also be embedded in browser contexts. Any deployment of locutus prior to 3.0.0, regardless of installed Node.js version, is at risk.

CVSS core score of 8.1 indicates a high‑severity vulnerability. The EPSS score of less than 1% suggests that exploitation is currently unlikely to be widespread, and the flaw is not listed in the CISA KEV catalog. Nonetheless, because the bug allows arbitrary code execution, defenders should treat it as a high risk threat vector. An attacker could exploit the flaw remotely by injecting malicious payloads into a callback array that the application passes to call_user_func_array, which is then evaluated.