Critical severity9.8OSV Advisory· Published Feb 3, 2026· Updated Jun 17, 2026
CVE-2025-69983
CVE-2025-69983
Description
FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
fuxa-servernpm | <= 1.2.7 | — |
Affected products
3untagged-fb3c7751ca725cb671dd, v.1.1.18, v1.0.0, …+ 1 more
- (no CPE)range: untagged-fb3c7751ca725cb671dd, v.1.1.18, v1.0.0, …
- cpe:2.3:a:frangoteam:fuxa:1.2.7:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-5r63-q8hg-p8qxghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-69983ghsaADVISORY
- github.com/frangoteam/FUXA/blob/master/server/api/projects/index.jsnvdProductWEB
News mentions
0No linked articles in our index yet.