AIKIDO-2026-10850

TL;DR

The PHP-compatible json_decode implementation in Locutus could fall back to parsing input with eval('(' + text + ')') when the host JSON.parse was unavailable. Attacker-controlled JSON strings that passed the legacy json2.js-style checks could then execute arbitrary JavaScript in the host process. Modern Node and browsers normally used JSON.parse first, but the fallback remained a documented unsafe code path. Version 3.0.35 removes the eval fallback and returns null with a syntax error state when JSON.parse is not available.