@frangoteam/fuxa (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package @frangoteam/fuxa, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (5)

• CVE-2023-33831 — CVSS 9.8 (critical): A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands…
• CVE-2025-69971 — CVSS 9.8 (critical): FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to…
• CVE-2025-69985 — CVSS 9.8 (critical): FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in…
• CVE-2021-45851 — CVSS 7.5 (high): A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the…
• CVE-2023-31716 — CVSS 7.5 (high): FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log