A critical remote code execution vulnerability in the Locutus JavaScript library allows unauthenticated attackers to inject and execute arbitrary code.

This flaw is caused by an insecure implementation of the call_user_func_array and call_user_func functions, which fail to validate callback array components before passing them to the eval() function. This allows an unauthenticated remote attacker to trigger arbitrary code execution within the runtime environment.

The ability to execute arbitrary code on a server or client environment poses a severe risk of complete system compromise, including unauthorized data access, modification, or destruction. With a CVSS score of 8.1, this vulnerability represents a high-severity threat that could lead to significant operational disruption and loss of confidentiality or integrity.

Immediate Action: Update the Locutus package to version 3.0.0 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor application logs for unexpected calls to dynamic evaluation functions or suspicious patterns involving callback arrays.

Compensating Controls: If immediate patching is not feasible, implement strict input validation and sanitization for any data passed into callback functions and utilize Content Security Policy (CSP) to restrict unauthorized script execution.

Public Exploit Available: Unknown

Given the potential for remote code execution, this vulnerability poses a substantial security risk to any application utilizing the affected Locutus library. Organizations must prioritize upgrading to version 3.0.0 to remediate the underlying flaw in the call_user_func_array implementation. Failure to address this update could expose the environment to full system compromise by unauthenticated remote actors.