agentprime: labring-fastgptEvery new CVE for labring-fastgpt.https://agentprime.io/CVE-2026-84301: FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requestshttps://agentprime.io/advisories/CVE-2026-84301/https://agentprime.io/advisories/CVE-2026-84301/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 22 Sep 2026 16:50:19 GMTCVECVE-2026-68929: FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorizationhttps://agentprime.io/advisories/CVE-2026-68929/https://agentprime.io/advisories/CVE-2026-68929/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 20:21:30 GMTCVEcriticalCVE-2026-61643: FastGPT: workflow runtime can execute another user's private HTTP toolsethttps://agentprime.io/advisories/CVE-2026-61643/https://agentprime.io/advisories/CVE-2026-61643/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 17:03:22 GMTCVECVE-2026-50562: FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflowshttps://agentprime.io/advisories/CVE-2026-50562/https://agentprime.io/advisories/CVE-2026-50562/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 16:55:03 GMTCVEcriticalCVE-2026-61646: FastGPT: Shared axios SSRF guard validates only the initial URL before following redirectshttps://agentprime.io/advisories/CVE-2026-61646/https://agentprime.io/advisories/CVE-2026-61646/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 14:32:08 GMTCVECVE-2026-61644: FastGPT: /api/core/chat/record/getCollectionQuote can disclose cross-tenant dataset text due to an unbound initialId lookuphttps://agentprime.io/advisories/CVE-2026-61644/https://agentprime.io/advisories/CVE-2026-61644/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 14:30:26 GMTCVECVE-2026-61684: FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token')https://agentprime.io/advisories/CVE-2026-61684/https://agentprime.io/advisories/CVE-2026-61684/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 14:28:22 GMTCVECVE-2026-54602: FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecordhttps://agentprime.io/advisories/CVE-2026-54602/https://agentprime.io/advisories/CVE-2026-54602/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 21:24:20 GMTCVECVE-2026-54607: FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard)https://agentprime.io/advisories/CVE-2026-54607/https://agentprime.io/advisories/CVE-2026-54607/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 21:20:43 GMTCVECVE-2026-55418: FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)https://agentprime.io/advisories/CVE-2026-55418/https://agentprime.io/advisories/CVE-2026-55418/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 21:18:45 GMTCVECVE-2026-54601: FastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusionhttps://agentprime.io/advisories/CVE-2026-54601/https://agentprime.io/advisories/CVE-2026-54601/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Jul 2026 21:16:12 GMTCVECVE-2026-44287: FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*\(/ is bypassablehttps://agentprime.io/advisories/CVE-2026-44287/https://agentprime.io/advisories/CVE-2026-44287/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 29 May 2026 19:33:53 GMTCVECVE-2026-44285: FastGPT: SSRF Protection Bypass via `externalFile` in Dataset Preview APIhttps://agentprime.io/advisories/CVE-2026-44285/https://agentprime.io/advisories/CVE-2026-44285/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 29 May 2026 19:32:49 GMTCVECVE-2026-44286: FastGPT: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validationhttps://agentprime.io/advisories/CVE-2026-44286/https://agentprime.io/advisories/CVE-2026-44286/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 08 May 2026 22:17:17 GMTCVECVE-2026-44284: FastGPT: Stored MCP tool URL SSRF in FastGPT workflow executionhttps://agentprime.io/advisories/CVE-2026-44284/https://agentprime.io/advisories/CVE-2026-44284/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 08 May 2026 22:12:39 GMTCVECVE-2026-42345: FastGPT: Cloud metadata endpoint SSRF protection bypass via port specification, IPv6 mapping, hex/decimal IP encoding, and trailing dothttps://agentprime.io/advisories/CVE-2026-42345/https://agentprime.io/advisories/CVE-2026-42345/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 08 May 2026 22:11:09 GMTCVECVE-2026-42344: FastGPT: DNS rebinding TOCTOU bypass in isInternalAddress allows SSRF on all protected endpointshttps://agentprime.io/advisories/CVE-2026-42344/https://agentprime.io/advisories/CVE-2026-42344/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 08 May 2026 22:10:00 GMTCVECVE-2026-42343: FastGPT: Uncontrolled Resource Consumption leading to Sandbox Exhaustionhttps://agentprime.io/advisories/CVE-2026-42343/https://agentprime.io/advisories/CVE-2026-42343/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 08 May 2026 22:09:03 GMTCVECVE-2026-42302: FastGPT: Unauthenticated Remote Code Execution (RCE) via code-server Misconfiguration in agent-sandboxhttps://agentprime.io/advisories/CVE-2026-42302/https://agentprime.io/advisories/CVE-2026-42302/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 08 May 2026 22:05:49 GMTCVEcriticalCVE-2026-40352: FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeoverhttps://agentprime.io/advisories/CVE-2026-40352/https://agentprime.io/advisories/CVE-2026-40352/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Apr 2026 21:09:32 GMTCVECVE-2026-40351: FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypasshttps://agentprime.io/advisories/CVE-2026-40351/https://agentprime.io/advisories/CVE-2026-40351/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Apr 2026 21:05:05 GMTCVEcriticalCVE-2026-40252: Broken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPThttps://agentprime.io/advisories/CVE-2026-40252/https://agentprime.io/advisories/CVE-2026-40252/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 20:52:15 GMTCVECVE-2026-40100: FastGPT has Unauthenticated SSRF in /api/core/app/mcpTools/runTool via missing CHECK_INTERNAL_IP defaulthttps://agentprime.io/advisories/CVE-2026-40100/https://agentprime.io/advisories/CVE-2026-40100/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 16:39:25 GMTCVECVE-2026-34162: FastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Thefthttps://agentprime.io/advisories/CVE-2026-34162/https://agentprime.io/advisories/CVE-2026-34162/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 31 Mar 2026 13:43:20 GMTCVEcriticalCVE-2026-34163: Server-Side Request Forgery via MCP Tools Endpoint in FastGPThttps://agentprime.io/advisories/CVE-2026-34163/https://agentprime.io/advisories/CVE-2026-34163/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 31 Mar 2026 13:43:11 GMTCVECVE-2026-33075: FastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.ymlhttps://agentprime.io/advisories/CVE-2026-33075/https://agentprime.io/advisories/CVE-2026-33075/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 20 Mar 2026 08:37:16 GMTCVEcriticalCVE-2026-32128: FastGPT Python Sandbox Bypass of File-Write Restrictionhttps://agentprime.io/advisories/CVE-2026-32128/https://agentprime.io/advisories/CVE-2026-32128/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 11 Mar 2026 21:30:26 GMTCVECVE-2026-26075: Cross-Site Request Forgery (CSRF) in FastGPThttps://agentprime.io/advisories/CVE-2026-26075/https://agentprime.io/advisories/CVE-2026-26075/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 12 Feb 2026 21:42:58 GMTCVECVE-2026-26003: FastGPT Plugin forwarding request is not authenticated, posing a serious risk of attackhttps://agentprime.io/advisories/CVE-2026-26003/https://agentprime.io/advisories/CVE-2026-26003/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 10 Feb 2026 17:52:38 GMTCVECVE-2025-62612: FastGPT File Reading Node SSRF Vulnerabilityhttps://agentprime.io/advisories/CVE-2025-62612/https://agentprime.io/advisories/CVE-2025-62612/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Oct 2025 20:45:17 GMTCVECVE-2025-52552: FastGPT LastRoute Parameter on Login Page Vulnerable to Open Redirect and DOM-based XSShttps://agentprime.io/advisories/CVE-2025-52552/https://agentprime.io/advisories/CVE-2025-52552/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 21 Jun 2025 02:15:07 GMTCVECVE-2025-49131: FastGPT Sandbox Vulnerable to Sandbox Bypasshttps://agentprime.io/advisories/CVE-2025-49131/https://agentprime.io/advisories/CVE-2025-49131/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Jun 2025 12:42:46 GMTCVECVE-2025-27600: FastGPT SSRFhttps://agentprime.io/advisories/CVE-2025-27600/https://agentprime.io/advisories/CVE-2025-27600/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Mar 2025 19:05:59 GMTCVE