CVE-2026-47720: Fuxa server SQL Injection Vulnerability
MODERATECVE-2026-47720 is a MODERATE (CVSS 5.3) sql injection vulnerability (CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) affecting Fuxa server libraries in the npm ecosystem. The issue involves fuxa has sql injection in its tdengine daq connector via backslash bypass of escapetdstring. Remediation is available in the latest vendor maintenance releases.
CVE-2026-47720 at a Glance
Security Impact
CVSS: 5.3
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
How to Fix CVE-2026-47720
To remediate this vulnerability, upgrade all affected Fuxa server dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install fuxa-server@Latest secure releaseRun the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls fuxa-serverHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-47720, inspect your project dependencies using npm:
npm ls fuxa-serverAnalyze the terminal output to locate any version of Fuxa server in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: The npm ls fuxa-server command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), where the product constructs all or part of an sql command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended sql command when it is sent to a downstream component. without sufficient removal or quoting of sql syntax in user-controllable inputs, the generated sql query can cause those inputs to be interpreted as sql instead of ordinary user data. In Fuxa server, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-47720 Affected Fuxa server Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
fuxa-server
|
npm |
≤ 1.1.14-1243
|
|
References
Frequently Asked Questions
What is CVE-2026-47720?
Which Fuxa server versions are affected?
What version fixes CVE-2026-47720?
Is fuxa-server affected?
What is the CVSS score of CVE-2026-47720?
What CWE is associated with CVE-2026-47720?
How can I check npm dependencies for CVE-2026-47720?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-h9fj-c2qr-76g2",
"modified" : "2026-06-08T23:06:43Z",
"published" : "2026-06-08T23:06:43Z",
"aliases" : [ "CVE-2026-47720" ],
"summary" : "FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString",
"details" : "## Summary\n\nThe TDengine DAQ storage connector's `escapeTdString` at `server/runtime/storage/tdengine/index.js:10` doubles single quotes but does not escape backslashes. TDengine's SQL parser treats `\\'` as a literal single quote inside a string, so a tag id of the form `x\\' OR 1=1--` escapes the first single quote, lets the doubled quote close the string, and appends an injected clause that runs on the TDengine server. An attacker (Alice) sends the crafted `sids` value through `GET /api/daq` or the Socket.IO `DAQ_QUERY` event and reads every row in `fuxa.meters`, which holds the historical tag values of every PLC the FUXA instance records.\n\n## Details\n\nThe TDengine DAQ storage connector did not correctly sanitize user-controlled values before including them in SQL queries.\n\nA specially crafted tag identifier could bypass the intended escaping logic and alter the query executed against the TDengine database.\n\nThis could allow unauthorized access to historical DAQ data stored in TDengine, including recorded tag values and related metadata.\n\nThe issue has been fixed in version 1.3.2 by improving input escaping in the TDengine connector.\n\n## Impact\n\nAn attacker with network access to a FUXA instance configured with TDengine as the DAQ backend reads the entire historical tag-value archive: every PLC tag the instance has recorded, plus the associated device ids and device names. Turning on authentication does not close the gap: the Socket.IO `DAQ_QUERY` handler has no authorization check, and `/api/daq` accepts guest-level requests. No login is needed in the default configuration.\n\n**CVSS 3.1**: `AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N` (Medium, 5.3). CWE-89.\n---\nA fix is available at https://github.com/frangoteam/FUXA/releases/tag/v1.3.2.\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "fuxa-server"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "1.1.14-1243"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/frangoteam/FUXA/security/advisories/GHSA-h9fj-c2qr-76g2"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/frangoteam/FUXA"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-89" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-06-08T23:06:43Z",
"nvd_published_at" : null
}
}