{"id":"EUVD-2026-46522","enisaUuid":"3c42d193-3e06-35f1-870f-612a47aa394a","description":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script\u0027s permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script\u0027s code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue.","datePublished":"Jul 21, 2026, 9:33:09 PM","dateUpdated":"Jul 23, 2026, 1:57:18 PM","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","references":"https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6\nhttps://github.com/frangoteam/FUXA/pull/2260\nhttps://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4\nhttps://github.com/frangoteam/FUXA/releases/tag/v1.3.1\n","aliases":"CVE-2026-43947\nGHSA-rg3m-cfq7-g6h6\n","assigner":"GitHub_M","epss":0.91,"enisaIdProduct":[{"id":"2f2b1847-1bb9-394a-8b9e-f0ef83b345a6","product":{"name":"FUXA","vendor":{"name":"frangoteam"}},"product_version":"\u003d 1.3.0"}],"enisaIdVendor":[{"id":"0893007b-0f34-3744-8e67-4f8d08011426","vendor":{"name":"frangoteam"}}],"enisaIdVulnerability":[{"id":"3c10643a-4161-3555-8ca6-ebcd676d0979","vulnerability":{"id":"GHSA-rg3m-cfq7-g6h6","description":"FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass","datePublished":"May 26, 2026, 11:44:52 PM","dateUpdated":"May 26, 2026, 11:44:52 PM","baseScore":0.0,"references":"https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6\nhttps://github.com/frangoteam/FUXA/pull/2260\nhttps://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4\nhttps://github.com/frangoteam/FUXA\nhttps://github.com/frangoteam/FUXA/releases/tag/v1.3.1\n","enisa_id":"EUVD-2026-46522\n","aliases":"CVE-2026-43947\nGHSA-rg3m-cfq7-g6h6\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a3455b66-a2f6-3f19-be69-8139e406adb5","vulnerability":{"id":"CVE-2026-43947","description":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script\u0027s permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script\u0027s code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue.","datePublished":"Jul 21, 2026, 9:33:09 PM","dateUpdated":"Jul 23, 2026, 1:57:18 PM","status":"PUBLISHED","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","references":"https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6\nhttps://github.com/frangoteam/FUXA/pull/2260\nhttps://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4\nhttps://github.com/frangoteam/FUXA/releases/tag/v1.3.1\n","enisa_id":"EUVD-2026-46522\n","assigner":"GitHub_M","epss":0.91,"dataProcessed":"Nov 7, 2026, 7:21:53 AM","vulnerabilityProduct":[{"id":"32833d15-7bdd-3740-94da-1a93da37e072","product":{"name":"FUXA","vendor":{"name":"frangoteam"}},"product_version":"\u003d 1.3.0"}],"vulnerabilityVendor":[{"id":"c0bc29cd-1c64-3d84-af54-2ec7378c9073","vendor":{"name":"frangoteam"}}]}}],"enisaIdAdvisory":[]}