A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA

Description

A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.13

References

• GHSA-r87q-fq37-pvr6
• youtu.be
• CVE-2023-33831
• CWE-77
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• JSONPath Plus Remote Code Execution (RCE) Vulnerability - CVE-2024-21534
• MCP Connect has unauthenticated remote OS command execution via /bridge endpoint - Vulnerability
• Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability - CVE-2026-41265
• FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection - CVE-2026-43945

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

How do hackers hack websites?

Tags:

npm

@frangoteam/fuxa