CVE-2026-33075 Details
Description
FastGPT is an AI Agent building platform. In versions 4.14.8.3 and below, the fastgpt-preview-image.yml workflow is vulnerable to arbitrary code execution and secret exfiltration by any external contributor. It uses pull_request_target (which runs with access to repository secrets) but checks out code from the pull request author's fork, then builds and pushes Docker images using attacker-controlled Dockerfiles. This also enables a supply chain attack via the production container registry. A patch was not available at the time of publication.
A vulnerability allowing arbitrary code execution and secret exfiltration has been identified in the FastGPT AI agent building platform, specifically in versions through 4.14.8.3. The issue arises within the GitHub Actions workflow file 'fastgpt-preview-image.yml', which is triggered by pull requests. This workflow runs with access to repository secrets but checks out code from the contributor's fork, allowing for the execution of malicious Dockerfiles. As a result, an attacker could exfiltrate sensitive information or introduce backdoors via the Docker images pushed to the production container registry.
Users are advised to rotate all exposed secrets, audit their Aliyun registry for any unexpected image pushes or tag overwrites, and scope registry credentials to a dedicated service account with limited permissions. Additionally, the workflow can be modified to use 'pull_request' instead of 'pull_request_target', require maintainer approval before running, or be split into two separate workflows.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/labring/FastGPT/security/advisories/GHSA-xfx8-w35j-485c | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-494 | Download of Code Without Integrity Check | [email protected] |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fastgpt fastgpt | <= 4.14.8.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |