CVE-2026-43947

Name of the Vulnerable Software and Affected Versions FUXA version 1.3.0

Description An unauthenticated Remote Code Execution issue exists when secureEnabled is set to true. The POST /api/runscript endpoint validates authorization based on a stored script's permission by ID. However, if test: true is included in the request, the system compiles and executes attacker-supplied code instead of the stored script. An unauthenticated attacker can execute arbitrary code if they possess a valid script ID and name, and at least one server-side script exists in the project without restrictive permissions. Script IDs and names can be obtained via the GET /api/project endpoint. The exploitation process involves the runTestScript function, which uses Module. compile to execute the code variable from the request body with full access to the Node.js runtime, including child process and fs.

Recommendations Update FUXA to version 1.3.1. As a temporary mitigation, restrict access to the POST /api/runscript endpoint.