CVE-2025-69983: FUXA Server Remote Code Execution Vulnerability
Summary
CVE-2025-69983: FUXA allows Remote Code Execution (RCE) via the project import functionality. Affects fuxa-server versions < 1.2.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FUXA is an open-source project management tool that allows users to import and manage various project files. The application is built on Node.js and is widely used for its simplicity and flexibility in handling project data. However, FUXA v1.2.7 has a critical vulnerability that allows for remote code execution through its project import functionality, exposing users to significant security risks.
Vulnerability Detail
FUXA v1.2.7 contains a vulnerability that allows remote code execution (RCE) via the project import feature. The application fails to properly sanitize or sandbox user-supplied scripts within imported project files. This oversight enables an attacker to upload a malicious project containing system commands, which can lead to full system compromise. The vulnerability is classified under CWE-78, indicating a command injection risk, and has a CVSS score of 8.1, highlighting its severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should avoid importing untrusted project files and ensure that all project imports are from verified sources. Additionally, consider implementing strict input validation and sanitization for any project files being imported.
Conclusion
The CVE-2025-69983 vulnerability in FUXA v1.2.7 poses a significant risk due to its potential for remote code execution. Users are strongly advised to update to the latest version of the package to mitigate this risk. Additionally, employing strict validation measures for project imports can help protect against exploitation.
See every vulnerability recorded for fuxa-server →
FAQ
The vulnerability allows attackers to execute arbitrary code on the server, potentially leading to full system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, ensure that you do not import any untrusted project files and validate all inputs rigorously.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can find more information on the official FUXA GitHub repository and security advisories related to the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for fuxa-server.
