{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.1.13"}],"component":"@frangoteam/fuxa","cve_ids":["CVE-2023-33831"],"ecosystem":"npm","epss":0.25951,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-r87q-fq37-pvr6","id":"tcs_01M5KG8F809G387A49EPC1PP71","modified_at":"2023-11-08T04:12:41.726401Z","published_at":"2023-09-18T21:30:42Z","references":["https://osv.dev/vulnerability/GHSA-r87q-fq37-pvr6","https://nvd.nist.gov/vuln/detail/CVE-2023-33831","https://github.com/frangoteam/FUXA","https://github.com/rodolfomarianocy/Unauthenticated-RCE-FUXA-CVE-2023-33831","https://youtu.be/Xxa6yRB2Fpw"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-r87q-fq37-pvr6","url":"https://osv.dev/vulnerability/GHSA-r87q-fq37-pvr6"}],"summary":"A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA"}