The vulnerability allows an unauthenticated attacker to execute arbitrary code by exploiting the test mode in the POST /api/runscript endpoint when secureEnabled is true. Although the endpoint normally verifies script permissions by ID, providing test: true causes the server to compile and run the supplied code instead of the stored script. The attacker only needs a valid script ID and name, which can be discovered via an unrelated information‑disclosure in GET /api/project. Because these prerequisites are minimal—requiring at least one server‑side script that is accessible without restrictive permissions—the exploit results in full remote code execution on the host.

The issue appears only in FUXA version 1.3.0, deployed by frangoteam. Versions 1.3.1 and higher contain the fix. The vulnerability requires that at least one server‑side script exists in the project and that secureEnabled is enabled. Any system using the vulnerable versions and is at risk.

The CVSS score of 8.9 indicates high severity; the EPSS score for the current data is less than 1 %, suggesting exploitation is presently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack vector is remote, unauthenticated and requires only knowledge of a script ID, which can be discovered via a separate information‑disclosure issue on GET /api/project. An attacker could thus remotely execute code on the host without prior authentication or physical access.