CVE-2026-29091

High

Advisory

Published 4 Mar 2026In the index since 6 Sept 2026

locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection

Carried by container images the latest versions of 2 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
locutusnpm	2.0.10, 2.0.11	3.0.0	2

2 by stars

Chart

Latest

Affected images

Radar Score

hubotdecayofmind

1 of the 3 container images this version deploys carry CVE-2026-29091.

Container image	Digest	Package	Fixed in
decayofmind/hubot :3.3.2	1e18e92fe694	locutus@2.0.11	3.0.0

2,513

hubotcloudnativeapp

1 of the 1 container images this version deploys carry CVE-2026-29091.

Container image	Digest	Package	Fixed in
minddocdev/hubot :0.1.9	6c60b11a4fa7	locutus@2.0.10	3.0.0

2,580

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
decayofmind/hubot :3.3.2	1e18e92fe694	locutus@2.0.11	3.0.0	1
minddocdev/hubot :0.1.9	6c60b11a4fa7	locutus@2.0.10	3.0.0	1