CVE-2026-32128: Fastgpt

Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days.

FastGPT is an AI Agent building platform. In 4.14.7 and earlier, FastGPT's Python Sandbox (fastgpt-sandbox) includes guardrails intended to prevent file writes (static detection + seccomp). These guardrails are bypassable by remapping stdout (fd 1) to an arbitrary writable file descriptor using fcntl. After remapping, writing via sys.stdout.write() still satisfies the seccomp rule write(fd==1), enabling arbitrary file creation/overwrite inside the sandbox container despite the intended no file writes restriction.

Affected products

• Fastgpt Fastgpt: up to and including 4.14.7

Published 2026-03-11. Last modified 2026-06-17.