Unauthenticated Remote Code Execution in FUXA Web-based Process Visualization Software

CVE-2026-43947

What is CVE-2026-43947?

FUXA, a web-based Process Visualization software, is susceptible to an unauthenticated Remote Code Execution vulnerability when the 'secureEnabled' setting is enabled. The issue arises from the handling of requests to the '/api/runscript' endpoint, where an attacker can execute arbitrary code if they possess a valid script ID and name and set 'test: true' in the request. This vulnerability occurs because the software compiles and executes the attacker-supplied code instead of relying on the intended stored script code. Access to script IDs and names can be easily achieved through unauthenticated information exposure in the '/api/project' request. The vulnerability is mitigated in version 1.3.1, which addresses these security concerns effectively.

References