CVE-2025-69983 is a critical remote code execution flaw (CVSS 9.8) in FUXA 1.2.7. The project import feature does not sanitize or sandbox scripts in imported project files, which can lead to full system compromise. The record names no fixed version. Check the FUXA repository.
What's affected
- FUXA v1.2.7, confirmed in the record.
- Affected feature: project import, in server/api/projects/index.js.
- Fixed version: not stated in the record. Check the FUXA repository.
How to check if you're exposed
Confirm the FUXA version, and check who can reach the import function. The record describes the attack as importing a project, so the question is whether an untrusted person can upload one.
Also review your own process. Project files shared by email or downloaded from forums should be treated like executable code, because FUXA projects contain scripts.
What to do now
- Inventory FUXA servers and versions.
- Upgrade to a fixed release when the project provides one.
- Only import project files from sources you trust and have reviewed.
- Restrict access to the FUXA editor and import function to named engineers.
- Run FUXA in a container or virtual machine with no route to other systems.
- Keep it off the internet.
Treat engineering workstations that edit FUXA projects as part of the attack surface too. If a project file travels through email or a shared drive, scan it, keep a reviewed copy, and record who approved it. Version control for projects helps you see what changed between two imports.
Why it matters
The weakness is CWE-94, improper control of code generation, better known as code injection. FUXA lets projects carry scripts, which is a feature. The problem is that imported scripts run without a sandbox and with the server's own rights, so a project file becomes a way to run commands.
The same release has an open upload endpoint and a hard-coded token secret, published as CVE-2025-69981 and CVE-2025-69971. Together they mean an outsider might reach the import function without credentials. The record does not list this CVE as exploited in the wild.
Quick check
Why treat a FUXA project file as code?
Projects hold scripts, and in 1.2.7 the imported scripts are not sandboxed, so importing a malicious file can run commands on the server.
Sources
Last reviewed: 19 October 2026.
