FUXA allows Remote Code Execution (RCE) via the project import functionality.

CRITICAL 9.8CVE-2025-69983 · GHSA-5r63-q8hg-p8qx · Published 03/02/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
fuxa frangoteam	`= 1.2.7`	No fix yet
fuxa-server npm	`≤ 1.2.7`	No fix yet

Description

FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-69983 · ADVISORY
frangoteam/FUXA · PACKAGE
frangoteam/FUXA · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free