Read the docs
TI-2026-25517 Aliases CVE-2026-33075

FastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.yml

Priority MEDIUM 48CWE-494Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-494.

Summary

FastGPT is an AI Agent building platform. In versions 4.14.8.3 and below, the fastgpt-preview-image.yml workflow is vulnerable to arbitrary code execution and secret exfiltration by any external contributor. It uses pull_request_target (which runs with access to repository secrets) but checks out code from the pull request author's fork, then builds and pushes Docker images using attacker-controlled Dockerfiles. This also enables a supply chain attack via the production container registry. A patch was not available at the time of publication.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00309 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
labringFastGPTup to 4.14.8.3—No fix listedCNA
  • FastGPT Vendorlabring Affected up to 4.14.8.3 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fastgpt:fastgpt:*:*:*:*:*:*:*:*up to 4.14.8.3VulnerableFastgpt
  • cpe:2.3:a:fastgpt:fastgpt:*:*:*:*:*:*:*:* Versions up to 4.14.8.3 Vulnerable ·Fastgpt

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33075

References

Exploit 1

  • TI-2026-30610 FastGPT: Unauthenticated Remote Code Execution (RCE) via code-server Misconfiguration in agent-sandbox CVSS 3.1CRITICAL 9.8
  • TI-2026-48466 FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization CVSS 4.0CRITICAL 9.3
  • TI-2026-44161 FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token') CVSS 4.0HIGH 8.8
  • TI-2026-44148 Incorrect authorization in labring FastGPT CVSS 3.1HIGH 7.7
  • TI-2026-39440 FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard) CVSS 3.1HIGH 7.7
  • TI-2026-30646 FastGPT: Uncontrolled Resource Consumption leading to Sandbox Exhaustion CVSS 4.0MEDIUM 6.3
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences