GHSA-p69w-mmfv-xrfj
NoneCVSS
—
EPSS
—
Published
May 26, 2026
CISA due date
—
The record
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @frangoteam/fuxa | 1.2.11 | 1.3.1 |
Related vulnerabilities
- CVE-2026-43945 FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection Same vulnerability
- GHSA-c8m8-3jcr-6rj5 FUXA has a hardcoded fallback JWT signing secret Also affects @frangoteam/fuxa
- GHSA-4r4r-4jp4-wwf9 FUXA has JWT Authentication Bypass via HTTP Referer header spoofing Also affects @frangoteam/fuxa
- CVE-2025-69985 FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote… Also affects @frangoteam/fuxa
- CVE-2025-69971 FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. Also affects @frangoteam/fuxa
- CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-284
- CVE-2026-83395 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-284
- CVE-2026-112091 A flaw has been found in Dav-ee dairy-management-system… CWE-284