EUVD-2026-13645Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessExternal contributor submits malicious pull request
-
DeliveryGitHub Actions checks out attacker's fork code
-
ExploitWorkflow executes with repository secrets access
-
ExecutionAttacker's Dockerfile builds arbitrary code
-
ImpactDocker image pushed to production registry
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Code integrity verification
|
| Exploitation Conditions | Attacker must be an external contributor with pull request creation privileges to the FastGPT repository (versions ≤4.14.8.3). The fastgpt-preview-image.yml workflow must be enabled. Attacker submits a malicious pull request containing a crafted Dockerfile; the workflow automatically executes with repository secrets access, enabling code execution and secret exfiltration. |
| Impact | This vulnerability presents critical real-world risk despite the absence of CVSS and EPSS scores. The attack vector is network-based with low complexity (external contributors can trigger via pull requests), requires no privileges or user interaction, and provides complete impact on confidentiality (secret exfiltration), integrity (code execution), and availability. The vulnerability is trivially exploitable by any external contributor without sophisticated tooling, making automation highly feasible under the SSVC framework. The lack of a patch at publication time, combined with the supply chain attack surface (compromised Docker images in production registries), elevates this beyond typical high-CVSS scenarios into a business-critical remediation priority. The fact that this affects an AI Agent platform compounds risk given its likely use in sensitive deployments. |
| Exploit ScenarioDerived | An attacker creates a forked repository with a malicious Dockerfile in the target FastGPT repository structure and opens a pull request from their fork. The pull_request_target workflow automatically executes with the repository's secrets (registry credentials, API keys), checks out the attacker's malicious Dockerfile, builds a Docker image containing exfiltrated secrets or backdoored code, and pushes it to the production container registry under the official FastGPT namespace. Downstream users who pull the compromised image unknowingly deploy the attacker's payload, establishing persistent compromise across FastGPT deployments in the wild—a textbook supply chain attack. No proof-of-concept needs to be sophisticated; the attack succeeds simply by crafting a malicious pull request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
FastGPT versions 4.14.8.3 and below contain a critical arbitrary code execution vulnerability in the fastgpt-preview-image.yml GitHub Actions workflow that allows external contributors to execute malicious code and exfiltrate repository secrets. The vulnerability stems from unsafe use of pull_request_target with attacker-controlled Dockerfile builds that are pushed to the production container registry, enabling both direct compromise and supply chain attacks. No patch was available at the time of public disclosure, making this an unpatched remote code execution affecting the AI Agent building platform across affected versions.
RemediationAI
Immediately disable the fastgpt-preview-image.yml workflow or restrict pull_request_target events to prevent external contributor execution until a patch is released by the FastGPT maintainers. Contact labring/FastGPT via their security advisory channel at https://github.com/labring/FastGPT/security/advisories/GHSA-xfx8-w35j-485c to request an urgent patch. As an interim mitigation, switch the workflow trigger from pull_request_target to pull_request (which runs in a sandboxed context without secrets access) if the workflow's functionality permits, or implement mandatory code review and approval requirements for all pull requests before workflow execution. Regenerate and rotate all repository secrets and container registry credentials that may have been exposed. Audit the production container registry for any images built during the vulnerable period and remove or rebuild them after patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-494 (Download of Code Without Integrity Check) and represents a GitHub Actions workflow security misconfiguration. FastGPT (CPE: cpe:2.3:a:labring:fastgpt:*:*:*:*:*:*:*:*) uses the pull_request_target trigger event, which executes with full access to repository secrets and elevated permissions, but unsafely checks out code from a pull request author's fork rather than validating its integrity. The workflow then uses this untrusted source to build Docker images and push them to a production container registry without validation. This combines GitHub Actions secrets exposure with container image supply chain compromise, allowing attackers to inject arbitrary code into both the build process and the resulting container artifact.
Know when Fastgpt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
FastGPT is an AI Agent building platform. In versions 4.14.8.3 and below, the fastgpt-preview-image.yml workflow is vulnerable to arbitrary code execution and secret exfiltration by any external contributor. It uses pull_request_target (which runs with access to repository secrets) but checks out code from the pull request author's fork, then builds and pushes Docker images using attacker-controlled Dockerfiles. This also enables a supply chain attack via the production container registry. A patch was not available at the time of publication.
Executive ViewAI
Organizations using FastGPT face significant risk from CVE-2026-33075 rated CVSS 8.8. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable t
Unauthenticated HTTP proxy abuse in FastGPT (AI Agent platform) prior to v4.14.9.5 allows remote attackers to relay arbi
Remote code execution in FastGPT's agent-sandbox component (versions 4.14.10 through 4.14.12) lets any network-adjacent,
NoSQL injection in FastGPT <4.14.9.5 password authentication allows unauthenticated remote attackers to bypass login con
Channel hijack and denial of service in FastGPT (labring/FastGPT) before 4.15.2 lets an unauthenticated remote attacker
GitHub Actions artifact-poisoning (pwn request) in labring/FastGPT allows an external attacker who opens a pull request
Authentication bypass in FastGPT 4.15.0-beta4 lets unauthenticated remote attackers forge JWTs and access internal plugi
NoSQL injection in FastGPT versions before 4.14.9.5 allows authenticated attackers to bypass password verification on th
Cross-tenant file disclosure in FastGPT prior to v4.15.0-beta5 allows an attacker to read another team's stored files by
Cross-tenant data disclosure in FastGPT 4.14.17 through 4.15.0-beta5 lets a low-privileged tenant user read another tena
Server-side request forgery in FastGPT before 4.15.0-beta4 lets an authenticated team member abuse the HTTP-tool OpenAPI
Server-Side Request Forgery in Labring FastGPT prior to 4.15.0-beta1 lets an authenticated attacker bypass the platform'
Exploit-DB