Sign in
Deutsch English Español Polski
High

FUXA allows Remote Code Execution (RCE) via the project import functionality.

  • Disclosed: 03.02.2026
  • Updated: 11.10.2026 10:22

FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package fuxa-server <= 1.2.7 no fix

References

CVSS score 9.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-78, CWE-94
Platform
npm
Package
fuxa-server
Disclosed
03.02.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-5r63-q8hg-p8qx - CC BY 4.0

Vulnerability history: fuxa-server

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (21) in the archive
Total entries
21
First → latest
09.2023 06.2026
Without a fix
9
Exploited in attacks
0

Severity breakdown

  • Critical 8
  • High 10
  • Medium 3

Disclosures per year

Severity:
  1. FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
    High · 8.2 CVE-2026-47719 <= 1.1.14-1243 no fix
  2. FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
    High · 7.5 CVE-2026-47717 >= 1.3.0, < 1.3.1 1.3.1
  3. FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
    High CVE-2026-43947 >= 1.3.0, < 1.3.1 1.3.1
  4. FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
    High CVE-2026-43946 >= 1.3.0, < 1.3.1 1.3.1
  5. FUXA Affected by a Path Traversal Sanitization Bypass
    High CVE-2026-25951 < 1.2.11 1.2.11
  6. FUXA Unauthenticated Remote Arbitrary Scheduler Write
    Critical CVE-2026-25939 >= 1.2.8, < 1.2.11 1.2.11
  7. FUXA Unauthenticated Remote Code Execution in Node-RED Integration
    Critical CVE-2026-25938 >= 1.2.8, < 1.2.11 1.2.11
  8. FUXA Unauthenticated Remote Arbitrary Device Tag Write
    Critical CVE-2026-25752 < 1.2.10 1.2.10
  9. FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
    Critical CVE-2026-25895 < 1.2.10 1.2.10
  10. FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration
    Critical CVE-2026-25894 < 1.2.10 1.2.10
  11. FUXA Unauthenticated Exposure of Plaintext Database Credentials
    Critical CVE-2026-25751 < 1.2.10 1.2.10
  12. FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
    Critical CVE-2026-25893 < 1.2.10 1.2.10
  13. FUXA allows Remote Code Execution (RCE) via the project import functionality. this entry
    High · 9.8 CVE-2025-69983 <= 1.2.7 no fix
  14. FUXA contains an Unrestricted File Upload vulnerability
    High CVE-2025-69981 <= 1.2.7 no fix
  15. FUXA contains an insecure default configuration vulnerability
    High CVE-2025-69970 <= 1.2.7 no fix
  16. FUXA SQL Injection vulnerability
    Critical · 9.8 CVE-2023-31719 <= 1.1.12 no fix
  17. FUXA local file inclusion vulnerability
    High · 7.5 CVE-2023-31718 <= 1.1.12 no fix
  18. FUXA SQL Injection vulnerability
    High · 7.5 CVE-2023-31717 <= 1.1.12 no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.