Unauthenticated remote code execution in FUXA via script test mode (CVE-2026-43947)

An authorization confused deputy vulnerability in FUXA allows unauthenticated attackers to execute arbitrary code on the server. The `POST /api/runscript` endpoint validates permissions against a stored script's ID, but when `test: true` is included in the request, attacker-supplied code is compiled and executed instead of the stored script's code. Combined with automatic guest JWT issuance and unauthenticated script ID disclosure via `GET /api/project`, any network-reachable attacker can achieve full remote code execution on the FUXA host without credentials. Affected versions: - 1.3.0 We recommend updating to: >= 1.3.1. CVSS 8.9 · our assessment: this_week Reference: https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6 Details: https://vuln.today/cve/CVE-2026-43947