CVE-2026-32128 Details
Description
FastGPT is an AI Agent building platform. In 4.14.7 and earlier, FastGPT's Python Sandbox (fastgpt-sandbox) includes guardrails intended to prevent file writes (static detection + seccomp). These guardrails are bypassable by remapping stdout (fd 1) to an arbitrary writable file descriptor using fcntl. After remapping, writing via sys.stdout.write() still satisfies the seccomp rule write(fd==1), enabling arbitrary file creation/overwrite inside the sandbox container despite the intended no file writes restriction.
A vulnerability in FastGPT's Python Sandbox component, in versions through 4.14.7, allows users to bypass restrictions intended to prevent file write operations. The sandbox's guardrails, which include static detection and seccomp policies, can be circumvented by remapping the standard output file descriptor to a writable one using the fcntl system call. This manipulation enables arbitrary file creation or overwriting within the sandbox container, exploiting the fact that the seccomp rule only allows writes to stdout or stderr.
It is recommended to restrict the open and openat syscalls to read-only access, allowing only safe flags, and to block file descriptor duplication or remapping via fcntl. These measures would prevent the manipulation of stdout or stderr to achieve unauthorized file write operations.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/labring/FastGPT/security/advisories/GHSA-6hw6-mxrm-v6wj | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-184 | Incomplete List of Disallowed Inputs | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fastgpt fastgpt | <= 4.14.7 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 19, 2026 | Initial Analysis | [email protected] |
| Mar 11, 2026 | New CVE Received | [email protected] |