CVE-2026-47720: SQL Injection Vulnerability in fuxa-server's TDengine DAQ Connector
Summary
CVE-2026-47720: FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString. Affects fuxa-server versions < 1.1.14-1243. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FUXA is an open-source framework designed for data acquisition and monitoring, primarily used in industrial applications. It integrates with various data storage solutions, including TDengine, to manage and analyze data from programmable logic controllers (PLCs). The fuxa-server package facilitates communication between the FUXA framework and the TDengine database, enabling users to store and retrieve historical data efficiently. However, a critical vulnerability has been identified in the TDengine DAQ connector, which could expose sensitive data to unauthorized users.
Vulnerability Detail
The vulnerability arises from improper input sanitization in the TDengine DAQ storage connector's escapeTdString function. This function, located in server/runtime/storage/tdengine/index.js, fails to escape backslashes, allowing an attacker to inject SQL commands. By crafting a specific tag identifier, such as x' OR 1=1--, an attacker can manipulate the SQL query executed against the TDengine database. This could lead to unauthorized access to historical DAQ data, including sensitive tag values and metadata. The vulnerability is classified as CVE-2026-47720 and has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement additional input validation and sanitization on the user-controlled values before they are processed by the TDengine DAQ connector. However, the best course of action is to update to the patched version.
Conclusion
The SQL injection vulnerability in the fuxa-server's TDengine DAQ connector poses a significant risk to users, allowing unauthorized access to sensitive data. It is crucial to update to the patched version to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert, which can provide real-time alerts without requiring code access.
See every vulnerability recorded for fuxa-server →
FAQ
CVE-2026-47720 is a SQL injection vulnerability found in the fuxa-server package's TDengine DAQ connector, allowing unauthorized access to sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
An attacker could read all historical tag values stored in the TDengine database, potentially exposing sensitive information related to PLCs.
No, even with authentication enabled, the vulnerability persists as the Socket.IO DAQ_QUERY handler lacks authorization checks.
You can update the fuxa-server package by running the command: npm install fuxa-server@1.3.2 in your terminal.
References
Related vulnerabilities
Recent vulnerabilities recorded for fuxa-server.
