A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA

Description

A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.13

References

• GHSA-r87q-fq37-pvr6
• youtu.be
• CVE-2023-33831
• CWE-77
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• JSONPath Plus Remote Code Execution (RCE) Vulnerability - CVE-2024-21534
• FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API - CVE-2026-25895
• FUXA allows Remote Code Execution (RCE) via the project import functionality. - CVE-2025-69983
• @saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defst - Vulnerability

Tags:

npm

@frangoteam/fuxa