{"id":"CVE-2026-32128","aliases":["EUVD-2026-11408","GHSA-6hw6-mxrm-v6wj"],"status":"published","title":"FastGPT Python Sandbox Bypass of File-Write Restriction","description":"FastGPT is an AI Agent building platform. In 4.14.7 and earlier, FastGPT's Python Sandbox (fastgpt-sandbox) includes guardrails intended to prevent file writes (static detection + seccomp). These guardrails are bypassable by remapping stdout (fd 1) to an arbitrary writable file descriptor using fcntl. After remapping, writing via sys.stdout.write() still satisfies the seccomp rule write(fd==1), enabling arbitrary file creation/overwrite inside the sandbox container despite the intended no file writes restriction.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00347,"percentile":0.28504,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-184"],"published":"2026-03-11T21:30:26Z","modified":"2026-10-28T03:00:15Z","exploits":[{"source":"pocgithub","id":"qianlijaingshan/fastgpt-sandbox-audit","title":"qianlijaingshan/fastgpt-sandbox-audit","date":"2026-08-18","url":"https://github.com/qianlijaingshan/fastgpt-sandbox-audit"}],"products":[{"vendor":"fastgpt","product":"fastgpt"},{"vendor":"labring","product":"fastgpt"}],"references":[{"url":"https://github.com/labring/FastGPT/security/advisories/GHSA-6hw6-mxrm-v6wj","tags":["x_refsource_CONFIRM","Exploit","Mitigation","Vendor Advisory","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32128.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32128","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-32128","title":"FastGPT Python Sandbox Bypass of File-Write Restriction","description":"FastGPT is an AI Agent building platform. In 4.14.7 and earlier, FastGPT's Python Sandbox (fastgpt-sandbox) includes guardrails intended to prevent file writes (static detection + seccomp). These guardrails are bypassable by remapping stdout (fd 1) to an arbitrary writable file descriptor using fcntl. After remapping, writing via sys.stdout.write() still satisfies the seccomp rule write(fd==1), enabling arbitrary file creation/overwrite inside the sandbox container despite the intended no file writes restriction.","status":"published","published":"2026-03-11T21:30:26.336Z","modified":"2026-03-12T16:18:13.936Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T14:19:57.100857Z"}],"euvd":[{"id":"EUVD-2026-11408","description":"FastGPT is an AI Agent building platform. In 4.14.7 and earlier, FastGPT's Python Sandbox (fastgpt-sandbox) includes guardrails intended to prevent file writes (static detection + seccomp). These guardrails are bypassable by remapping stdout (fd 1) to an arbitrary writable file descriptor using fcntl. After remapping, writing via sys.stdout.write() still satisfies the seccomp rule write(fd==1), enabling arbitrary file creation/overwrite inside the sandbox container despite the intended no file writes restriction.","status":"published","published":"2026-03-11T21:30:26Z","modified":"2026-03-12T16:18:13Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:25:35.78849Z"}],"nvd":[{"id":"CVE-2026-32128","description":"FastGPT is an AI Agent building platform. In 4.14.7 and earlier, FastGPT's Python Sandbox (fastgpt-sandbox) includes guardrails intended to prevent file writes (static detection + seccomp). These guardrails are bypassable by remapping stdout (fd 1) to an arbitrary writable file descriptor using fcntl. After remapping, writing via sys.stdout.write() still satisfies the seccomp rule write(fd==1), enabling arbitrary file creation/overwrite inside the sandbox container despite the intended no file writes restriction.","status":"published","published":"2026-03-11T22:16:32.633Z","modified":"2026-06-17T10:35:11.16Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T14:12:08.98071Z"}],"osv":[{"id":"CVE-2026-32128","title":"FastGPT Python Sandbox Bypass of File-Write Restriction","description":"FastGPT is an AI Agent building platform. In 4.14.7 and earlier, FastGPT's Python Sandbox (fastgpt-sandbox) includes guardrails intended to prevent file writes (static detection + seccomp). These guardrails are bypassable by remapping stdout (fd 1) to an arbitrary writable file descriptor using fcntl. After remapping, writing via sys.stdout.write() still satisfies the seccomp rule write(fd==1), enabling arbitrary file creation/overwrite inside the sandbox container despite the intended no file writes restriction.","status":"published","published":"2026-03-11T21:30:26.336Z","modified":"2026-10-28T03:00:15.793307411Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T15:45:01.218144Z"}]}}