Locutus is a JavaScript library that emulates standard libraries from other languages for educational use. In versions before 3.0.14, the create_function(args, code) helper forwards both parameters directly to the JavaScript Function constructor without any sanitization. This lack of validation allows an attacker to inject arbitrary JavaScript code that will be executed with the privileges of the running Node.js process. The weakness corresponds to CWE-88 (Function Injection) and CWE-94 (Eval Injection). The practical consequence is Remote Code Execution, meaning an attacker can run any code, manipulate data, or further compromise the host system. The vulnerability is distinct from earlier versions that used eval.\n

The vulnerability affects the locutusjs:locutus library used in Node.js environments. All releases prior to 3.0.14 are impacted. The fix was introduced in version 3.0.14; any project that incorporates older versions of Locutus is susceptible.\n

The CVSS score is 9.8, indicating a high severity and full remote exploitation scope. The EPSS score is reported as less than 1%, suggesting that publicly exploited instances are rare, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is straightforward: any code that calls locutus.create_function with user-controllable arguments can trigger the dangerous Function constructor. Consequently, the risk is high for projects that use Locutus without restricting the input to create_function, and exploitation is feasible with minimal effort if the library is included and the function called. The combination of high severity and low public exploitation probability underscores the importance of rapid remediation.\n