# CVE-2023-33831: FUXA remote command execution in /api/runscript endpoint

Source: https://junglewise.ai/threats/cve-2023-33831-fuxa-remote-command-execution-in-api-runscript-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-09-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-33831 · Severity: low · CVSS 3.1 · Published 2023-09-18

FUXA is web-based industrial automation software used for process visualization, SCADA systems, and dashboards in critical infrastructure and manufacturing environments. An unauthenticated attacker can execute arbitrary commands on the server by sending a crafted request to the /api/runscript endpoint, potentially gaining complete control of the system and accessing sensitive operational data.

Technologies: [@frangoteam/fuxa (npm)](https://junglewise.ai/threats/technologies/frangoteam-fuxa). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-33831 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-33831 being exploited in the wild.

**How severe is CVE-2023-33831?** Low severity, with a CVSS score of 3.1, published 18 September 2023.

**Which products and versions are affected?** @frangoteam/fuxa (npm) SEMVER:introduced=0,last_affected=1.1.13.

**Is there a fix for CVE-2023-33831?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2023-33831 attacked?** It is attacked over the network.

**Am I affected by CVE-2023-33831?** Check whether you run @frangoteam/fuxa (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a command injection flaw (CWE-77, CWE-94) in the /api/runscript endpoint that fails to properly sanitize user input before executing system commands. An attacker can send a malicious POST request without authentication to inject and execute arbitrary shell commands with the privileges of the FUXA process. The attack vector is network-based with no authentication or user interaction required. Successful exploitation allows complete remote command execution, enabling an attacker to compromise the entire system. The vulnerability affects FUXA version 1.1.13 and all previous versions.

## Affected products

- Frango Team FUXA 1.1.13 and all previous versions

## Identifiers

- CVE-2023-33831
- GHSA-r87q-fq37-pvr6

## Timeline

- 2023-09-18: disclosed: Advisory published

## References

- [https://github.com/frangoteam/FUXA](https://github.com/frangoteam/FUXA)

## Related threats

- [frangoteam FUXA authentication bypass and RCE via path manipulation](https://junglewise.ai/threats/cve-2026-43945-frangoteam-fuxa-authentication-bypass-and-rce-via-path)
- [frangoteam FUXA hardcoded JWT signing secret fallback](https://junglewise.ai/threats/cve-2025-69971-frangoteam-fuxa-hardcoded-jwt-signing-secret-fallback)
- [FUXA authentication bypass in JWT middleware via Referer header spoofing](https://junglewise.ai/threats/cve-2025-69985-fuxa-authentication-bypass-in-jwt-middleware-via-referer-header)
- [FUXA local file inclusion via file parameter](https://junglewise.ai/threats/cve-2023-31716-fuxa-local-file-inclusion-via-file-parameter)
- [FUXA server-side request forgery](https://junglewise.ai/threats/cve-2021-45851-fuxa-server-side-request-forgery)