Search: CVE-2026-43947

FUXA version 1.3.0 contains an unauthenticated remote code execution vulnerability in the POST /api/runscript endpoint when secureEnabled is true. An attacker can exploit the test mode feature to execute arbitrary code by supplying a valid script ID and name. This occurs because the endpoint executes attacker-supplied code instead of the stored script's code when test: true is set. The vulnerability is fixed in version 1.3.1.