CVE-2025-69983
CVE-2025-69983
This page contains facts from public vulnerability sources. Check the original advisory before updating.
FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise.
CVSS 8.2 · High · EPSS 0.5%
- Published
- Updated
Stack: node
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
fuxa-server npm
- Affected ranges
- SEMVER: ≤ 1.2.7
No fix published