FastGPT EUVD-2026-33431

Exploitation requires a valid, low-privileged FastGPT user account (confirmed by CVSS PR:L) with access to the platform's JavaScript code sandbox execution feature. The sandbox must be running a Node.js version that supports native ES dynamic import() - modern Node.js versions (12+) satisfy this. The attacker submits JavaScript containing import//("child_process") where the block comment // sits between the import keyword and the opening parenthesis; no other configuration or setup is needed. Exploitation is bounded by the sandbox container: post-exploitation access is as uid=100(sandbox), and CVSS S:U confirms the exploit does not inherently escape the container boundary. Limiting factors are: (1) the requirement for an authenticated platform account, and (2) the JavaScript sandbox feature must be accessible to that account - installations where sandbox access is restricted to internal/admin roles have meaningfully reduced exposure.

CVSS 6.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The network attack vector and low complexity reflect that exploitation is straightforward once authenticated access is obtained - the bypass is a single-token substitution documented verbatim in the advisory. The PR:L (low-privilege) requirement is the primary limiting factor: the attacker must hold a valid FastGPT account with access to the code sandbox feature. Scope:Unchanged (S:U) and the CIA impact ratings of Low each indicate that post-exploitation impact is bounded by the sandbox container's privileges (uid=100), not the host system - lateral movement risk depends on the specific container network and privilege configuration, which is outside the CVE's scope. No CISA KEV listing and no EPSS data were provided; active exploitation cannot be confirmed. However, the trivial reproducibility of the bypass (inserting /**/ between import and the parenthesis) means the effective exploitation complexity is lower than AC:L already implies for anyone reading the advisory. The CVSS score underrepresents the ease of exploitation while appropriately capturing the contained blast radius.

An authenticated FastGPT user navigates to the code execution sandbox feature and submits the payload: import/**/("child_process"). The sandbox worker's regex fails to match the comment-obfuscated import, the Node.js runtime resolves the dynamic import successfully, and the user calls execSync('id') or any other OS command, achieving arbitrary command execution as uid=100(sandbox) inside the container. No separately published POC code exists beyond the bypass technique described in the vendor advisory, but the technique requires no specialized tooling.