FastGPT CVE-2026-42343

The FastGPT code-sandbox API endpoint must be network-accessible without authentication (default configuration). Exploitation requires the ability to send HTTP requests to the code-execution API and knowledge of or ability to infer the JavaScript worker pool size. The attack succeeds because: (1) no OS-level resource isolation restricts worker memory or CPU, (2) the 500ms polling interval for soft limits is sufficiently long to be bypassed via timing attacks, (3) the application does not implement per-user or per-request rate limits, and (4) concurrent requests are processed in parallel without meaningful queuing or backpressure. The vulnerability is NOT limited to specific configurations or non-default setups-it affects any FastGPT deployment where the code-sandbox component is enabled and network-accessible, which is the standard deployment model for an AI Agent building platform.

CVSS 6.3 with attack vector Network and complexity Low indicates a remotely exploitable vulnerability. However, the CVSS vector includes AT:P (Attack Timing: Possible), suggesting the attack requires timing precision or specific conditions to succeed reliably. The impact vector (VA:L, SA:N) classifies this as availability damage without integrity or confidentiality impact, consistent with a denial-of-service attack. EPSS data is not provided, limiting probability assessment. KEV status is not confirmed in provided data, and no public exploit code has been reported at time of analysis. The real-world risk is significant for FastGPT deployments because: (1) the vulnerability is in a core sandbox component handling untrusted code, (2) no patch exists yet forcing reliance on workarounds, (3) attack complexity is low and requires no authentication, and (4) the impact is complete service unavailability rather than isolated user impact. For organizations operating FastGPT in production as an AI Agent building platform serving multiple users, this represents a critical availability risk despite the moderate CVSS score.

An unauthenticated attacker sends a rapid burst of API requests to the code-sandbox endpoint, each containing a CPU-intensive JavaScript payload designed to execute longer than the 500ms polling interval. The soft memory limit is bypassed through timing attacks, and the JavaScript worker pool is exhausted as requests queue faster than workers complete execution. Subsequent legitimate user requests time out or fail, resulting in complete service denial.