---
id: CVE-2026-47720
title: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software
summary: >-
  FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.
  Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function
  in server/runtime/storage/tdengine/index.js doubles single quotes but does not
  escape …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-89
vendor: fuxa-server
product: fuxa-server
affected:
  - fuxa-server <= 1.1.14-1243
published: '2026-08-18'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:13:25.910'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47720'
references:
  - url: >-
      https://github.com/frangoteam/FUXA/commit/b78f6159d02a56ce5ff48207feb936afb3534fc8
    label: security-advisories@github.com
  - url: 'https://github.com/frangoteam/FUXA/pull/2343'
    label: security-advisories@github.com
  - url: 'https://github.com/frangoteam/FUXA/releases/tag/v1.3.2'
    label: security-advisories@github.com
  - url: 'https://github.com/frangoteam/FUXA/security/advisories/GHSA-h9fj-c2qr-76g2'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-h9fj-c2qr-76g2'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.0049
epssPercentile: 0.41274
aliases:
  - GHSA-h9fj-c2qr-76g2
ecosystem: npm
ingestedAt: '2026-07-07T15:41:59.837Z'
---

## Overview

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a crafted sids tag identifier through GET /api/daq or the Socket.IO DAQ_QUERY event so TDengine interprets the backslash and quote sequence as SQL syntax. The injected query can return every row from fuxa.meters, exposing historical PLC tag values, device identifiers, and device names even when FUXA authentication is enabled. This issue is fixed in version 1.3.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-47720)

Affected packages:

- `fuxa-server <= 1.1.14-1243`

Source: https://github.com/advisories/GHSA-h9fj-c2qr-76g2