An unauthenticated user can obtain a guest JSON Web Token from the heartbeat API and use it to bypass the secure-mode authorization gate in the Node-RED integration. This flaw allows the attacker to access the Node-RED editor, deploy function nodes, and invoke script execution endpoints such as fuxa.runScript and runtime.scriptsMgr.runScript. As a result the attacker can modify project data, configuration, and runtime helpers, and when unsafe modules are enabled they can execute operating-system commands through the exposed runtime APIs.

The vulnerability affects frangoteam’s FUXA web-based Process Visualization platform. All releases up to and including version 1.3.2 are vulnerable. The issue was addressed in release 1.3.3.

The CVSS score of 9.2 signals critical severity, and the exploitability is high because no authentication is required beyond a guest token. Although an EPSS score is not available, the flaw is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. A remote attacker can leverage the guest JWT and Node-RED APIs over HTTP to achieve full control of the FUXA instance and potentially the underlying operating system if unsafe modules are enabled.