fkie_cve-2026-43947

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script's permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue.

GHSA-rg3m-cfq7-g6h6 — FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

Affected: npm: fuxa-server

### Summary

An unauthenticated Remote Code Execution vulnerability exists in FUXA when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script's permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions.

Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately).

The only prerequisite is that at least one server-side script exists in the project.

### Details

**Authorization confused deputy in script execution**

File: `server/runtime/scripts/index.js`, lines 86-103

The authorization check looks up the stored script by ID and validates the stored script's `permission` field:

```javascript this.isAuthorised = function (_script, permission) { const st = scriptModule.getScript(_script); // finds stored script by _script.id if (admin || (st && (!st.permission || st.permission & permission))) { return true; } return false; } ```

When a script has no `permission` field set (or `permission: 0`), the expression `!st.permission` evaluates to `true`, and the check passes for any caller including guests.

**Guest auto-authentication in the m…

Most recent entries from all

fkie_cve-2026-43947

GHSA-rg3m-cfq7-g6h6 — FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass