FastGPT vulnerabilities

FastGPT before version 4.15.2 has unauthorized access to WeChat (iLink) share-channel endpoints using only the public shareId. An unauthenticated attacker can hijack a victim's WeChat channel, replace bot credentials, and expose private app responses.

In FastGPT up to commit 22ebfacbb43311e9b73294040ae0eb87390c6bba, artifacts built from untrusted pull request code in GitHub Actions workflows can be downloaded by privileged workflow_run jobs, allowing an attacker to push controlled Docker images to GHCR and, for documentation previews, deploy with the secret KUBE_CONFIG_CN.

FastGPT versions 4.14.10 through 4.14.13 contain an unauthenticated Remote Code Execution (RCE) vulnerability in the agent-sandbox component. The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to all network interfaces (0.0.0.0:8080), allowing any user with network access to bypass authentication and gain full control over the sandbox environment.

FastGPT before version 4.14.9.5 exposes the /api/core/app/httpTools/runTool endpoint without authentication. It acts as a full HTTP proxy, allowing attackers to make arbitrary HTTP requests from the server.

FastGPT prior to 4.15.2 has a DNS rebinding flaw in the safe Axios request interceptor in packages/service/common/api/axios.ts. The hostname is validated with isInternalAddress() before a later HTTP connection performs an independent DNS lookup, creating a time-of-check/time-of-use gap. An authenticated attacker who can supply a URL to a safe-Axios-backed HTTP tool, workflow HTTP node, external file fetch, or other server-side integration can reach services that direct private-address inputs would block.

FastGPT Community Edition versions 4.10.0 through 4.14.0 are vulnerable to NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat history titles of all users across the platform.

In FastGPT from version 4.14.17 to 4.15.0-beta5, an authenticated user can save a workflow node referencing another user's private HTTP toolset using a crafted tool ID. The lack of proper authorization checks in the workflow save and execution path allows execution of the victim-owned HTTP tool.

FastGPT version 4.15.0-beta4 has a vulnerability in reverse-call endpoints under /api/invoke/* that authenticate only via a JWT signed with a default constant secret 'token'. An unauthenticated attacker can self-sign an HS256 JWT and access cross-tenant user PII or write arbitrary content to chat files.

FastGPT before version 4.15.0-beta5 has an SSRF vulnerability where the guard validates only the initial request URL, and axios follows redirects by default. An authenticated workflow user can configure an HTTP request node to call an attacker-controlled public URL that redirects to cloud metadata, loopback, or internal services that the guard would block on direct request, and the HTTP node returns the response body to the workflow caller.

A vulnerability in FastGPT allows a low-privileged tenant user to access quotes or full-text content from another tenant's dataset by manipulating the initialId parameter in the POST /api/core/chat/record/getCollectionQuote endpoint. The issue affects versions from 4.14.17 to 4.15.0-beta5.

In FastGPT prior to v4.15.0-beta5, two file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object keys are global within the bucket and carry the tenant id only as a path segment, an attacker can supply another team's key and obtain its file contents through the chat-file presign endpoint or dataset preview endpoint.

In FastGPT prior to version 4.15.0-beta4, the HTTP-tool OpenAPI schema importer validates only the top-level URL before passing it to SwaggerParser.bundle, whose remote reference resolver fetches $ref URLs without FastGPT's internal-address guard and returns fetched content inline, allowing an authenticated team member to read internal services or cloud metadata.

In FastGPT before version 4.15.0, the GET /api/core/ai/record/getRecord endpoint authenticates the caller but loads LLM request and response traces only by requestId without team scoping. This allows any authenticated user to read another team's prompts, retrieved RAG chunks, and completions if the requestId is known.

A vulnerability in FastGPT allows an authenticated tenant user to call the POST /api/core/dataset/collection/create/reTrainingCollection endpoint in a way that persists a server-owned datasetId value from another tenant. This creates mixed dataset objects, and downstream endpoints make authorization decisions based on inconsistent ownership anchors, enabling cross-tenant read, update, and delete access when mixed object ids are known.

FastGPT before version 4.15.0-beta1 has a vulnerability in the JavaScript sandbox worker at projects/code-sandbox/src/pool/worker.ts:356. The regex blocking dynamic import() does not account for block comments between 'import' and '('. An attacker can use the payload import/**/("child_process") to bypass the regex and execute arbitrary commands as uid=100(sandbox) inside the sandbox container.

FastGPT, an AI Agent building platform, prior to version 4.15.0-beta1 contains an SSRF vulnerability. An authenticated attacker can bypass the global isInternalAddress network protection and make arbitrary HTTP GET requests to internal network services by exploiting an incomplete fix in the dataset preview endpoint /api/core/dataset/file/getPreviewChunks when using the externalFile data import type.

FastGPT before version 4.14.17 has an unauthenticated SSRF vulnerability. The fetchData function does not validate URLs against an internal blocklist, allowing requests to internal/private addresses.

FastGPT before 4.14.17 has an inconsistent SSRF protection gap in MCP tool URL handling. Preview/run endpoints reject internal URLs, but create/update endpoints can save an internal URL that is later used without revalidation.

FastGPT up to version 4.14.11 has an SSRF vulnerability in isInternalAddress() that uses startsWith() against a hardcoded list. Bypass is possible via at least 7 URL encoding techniques. Private IP checking is disabled by default.

FastGPT versions up to 4.14.11 are vulnerable to DNS rebinding (TOCTOU) in the isInternalAddress() function. The function checks the IP before the HTTP request, but a new DNS resolution during the request may return a different address, bypassing validation. No public patches available.

FastGPT versions up to 4.14.13 have weak resource isolation in the code-sandbox component. Lack of strict OS-level constraints (e.g., cgroups) allows attackers to bypass memory checks and exhaust the JavaScript worker pool, causing a complete Denial of Service (DoS).

In FastGPT prior to version 4.14.9.5, the MCP tools endpoints (/api/core/app/mcpTools/getTools and /api/core/app/mcpTools/runTool) accept a user-supplied URL parameter and make server-side HTTP requests without validating whether the URL points to an internal/private address. The isInternalAddress() function used in other endpoints is missing. An authenticated attacker can scan internal networks, access cloud metadata, and internal services (MongoDB, Redis).

FastGPT prior to version 4.11.1 has security-unsafe network link verification in the workflow file reading node, posing a risk of SSRF attacks. This issue has been patched in version 4.11.1.