GHSA-5r63-q8hg-p8qx
FUXA allows Remote Code Execution (RCE) via the project import functionality.
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | fuxa-server | <= 1.2.7 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise.
References
External links from the advisory. They lead to third-party sites.