GHSA-5r63-q8hg-p8qx

Source

https://github.com/advisories/GHSA-5r63-q8hg-p8qx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-5r63-q8hg-p8qx/GHSA-5r63-q8hg-p8qx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5r63-q8hg-p8qx

Aliases

CVE-2025-69983

Published

2026-02-03T18:30:47Z

Modified

2026-02-11T18:47:28Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
8.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

FUXA allows Remote Code Execution (RCE) via the project import functionality.

Details

FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise.

Database specific

{
    "cwe_ids":  [
        "CWE-78",
        "CWE-94"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-04T19:21:14Z",
    "nvd_published_at":  "2026-02-03T18:16:17Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / fuxa-server

Package

Name: fuxa-server; View open source insights on deps.dev
Purl: pkg:npm/fuxa-server

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.2.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-5r63-q8hg-p8qx/GHSA-5r63-q8hg-p8qx.json"