EUVD-2026-33431Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
FastGPT is an AI Agent building platform. Prior to 4.15.0-beta1, the JavaScript sandbox worker at projects/code-sandbox/src/pool/worker.ts:356 blocks dynamic import() with the regex /\bimport\s*\(/.test(code). JavaScript syntax accepts a block comment between import and (; the regex matches only ASCII whitespace, and the bytes /, *, *, / are not in the \s character class. The payload import/**/("child_process") parses as a syntactically valid dynamic import that the regex does not detect. Because import() is not wrapped by the safeRequire Proxy (which only proxies require), the attacker loads child_process and calls execSync - arbitrary command execution as uid=100(sandbox) inside the sandbox container. This vulnerability is fixed in 4.15.0-beta1.
AnalysisAI
Sandbox escape in FastGPT's JavaScript code execution worker allows authenticated remote attackers to execute arbitrary OS commands inside the sandbox container by bypassing a regex-based blocklist. The sandbox at projects/code-sandbox/src/pool/worker.ts:356 blocks dynamic import() using a regex that matches only ASCII whitespace between 'import' and '(', failing to account for JavaScript's syntactically valid block comment syntax - the payload import/**/("child_process") parses correctly by the JS engine but evades the regex entirely. Because the safeRequire Proxy only intercepts require() and not native ES import(), the attacker gains direct access to child_process and execSync as uid=100(sandbox). No public exploit identified at time of analysis, but the bypass technique is fully documented in the vendor advisory and is trivially reproducible by any authenticated user.
Technical ContextAI
FastGPT (CPE: cpe:2.3:a:labring:fastgpt:*:*:*:*:*:*:*:*) is a Node.js-based AI Agent platform that exposes a JavaScript sandbox for executing user-supplied code. The sandbox worker implements a regex blocklist (/\bimport\s*\() to prevent Node.js's native dynamic import() - an ES module feature that allows runtime module loading. However, the ECMAScript specification permits block comments (/* ... */) syntactically between import and its argument list, and the \s character class does not match the bytes comprising /* */. The sandbox's module access control relies on a safeRequire Proxy to intercept CommonJS require() calls, but this Proxy does not wrap native import(), leaving a gap when the regex guard fails. CWE-94 (Improper Control of Generation of Code - Code Injection) accurately describes the root cause: input code is evaluated without sufficient syntactic normalization (e.g., comment stripping or AST parsing) prior to blocklist enforcement.
RemediationAI
Upgrade FastGPT to version 4.15.0-beta1 or later, which addresses the regex bypass in the sandbox worker per the vendor advisory at https://github.com/labring/FastGPT/security/advisories/GHSA-f5mq-qxm4-5mvc. The upstream fix should replace or augment the regex-based blocklist with comment-stripping preprocessing or an AST-based analysis before blocklist evaluation - regex-based sandboxing of a full programming language is inherently fragile. As an immediate compensating control prior to patching, restrict access to FastGPT's code sandbox execution feature to only highly trusted, internal users by adjusting platform-level permissions, since exploitation requires authenticated access (PR:L). Additionally, audit sandbox container egress rules and drop unnecessary Linux capabilities to limit the scope of any successful exploitation to the container boundary. Note that restricting sandbox access may degrade core platform functionality for end users.
FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable t
Unauthenticated HTTP proxy abuse in FastGPT (AI Agent platform) prior to v4.14.9.5 allows remote attackers to relay arbi
Remote code execution in FastGPT's agent-sandbox component (versions 4.14.10 through 4.14.12) lets any network-adjacent,
NoSQL injection in FastGPT <4.14.9.5 password authentication allows unauthenticated remote attackers to bypass login con
GitHub Actions artifact-poisoning (pwn request) in labring/FastGPT allows an external attacker who opens a pull request
NoSQL injection in FastGPT versions before 4.14.9.5 allows authenticated attackers to bypass password verification on th
Authentication bypass in FastGPT 4.15.0-beta4 lets unauthenticated remote attackers forge JWTs and access internal plugi
Cross-tenant file disclosure in FastGPT prior to v4.15.0-beta5 allows an attacker to read another team's stored files by
Server-side request forgery in FastGPT before 4.15.0-beta4 lets an authenticated team member abuse the HTTP-tool OpenAPI
Server-Side Request Forgery in Labring FastGPT prior to 4.15.0-beta1 lets an authenticated attacker bypass the platform'
Server-side request forgery in FastGPT (labring) versions 4.14.11 and prior lets a low-privileged user coerce the server
Server-Side Request Forgery (SSRF) in FastGPT's Model Context Protocol (MCP) tools endpoints allows authenticated attack
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today