CVE-2025-49131
📋 TL;DR
CVE-2025-49131 is a sandbox escape vulnerability in FastGPT's sandbox container that allows attackers to break out of the isolated execution environment. This enables arbitrary file read/write operations and bypasses Python module restrictions. Organizations using FastGPT versions before 4.9.11 with the sandbox feature enabled are affected.
💻 Affected Systems
- FastGPT
📦 What is this software?
Fastgpt by Fastgpt
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the FastGPT host system, allowing attackers to execute arbitrary code, steal sensitive data, and pivot to other systems in the network.
Likely Case
Unauthorized access to sensitive files, modification of AI workflows, and potential data exfiltration from the FastGPT environment.
If Mitigated
Limited impact with proper network segmentation and minimal privileges, though sandbox isolation would still be compromised.
🎯 Exploit Status
Exploitation requires access to submit code to the sandbox, which typically requires some level of authentication or API access. The vulnerability involves syscall manipulation within container isolation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.9.11
Vendor Advisory: https://github.com/labring/FastGPT/security/advisories/GHSA-f3pf-r3g7-g895
Restart Required: Yes
Instructions:
1. Update FastGPT to version 4.9.11 or later. 2. Update the fastgpt-sandbox container image to the patched version. 3. Restart all FastGPT services and containers. 4. Verify the sandbox container is running the updated image.
🔧 Temporary Workarounds
Disable Sandbox Feature
allTemporarily disable the sandbox execution feature in FastGPT configuration
Set sandbox.enabled=false in FastGPT configuration
Restrict Sandbox Access
allLimit which users or API endpoints can submit code to the sandbox
Configure FastGPT ACLs to restrict sandbox access to trusted users only
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FastGPT from sensitive systems
- Apply additional container security controls like AppArmor or SELinux profiles
🔍 How to Verify
Check if Vulnerable:
Check FastGPT version and sandbox container version. If FastGPT < 4.9.11 and using sandbox features, the system is vulnerable.Check Version:
docker inspect fastgpt-sandbox | grep -i version && check FastGPT web interface or configuration for versionVerify Fix Applied:
Verify FastGPT version is 4.9.11 or later and the sandbox container image includes the security patch commit bb810a43a1c70683fab7f5fe993771e930a94426.📡 Detection & Monitoring
Log Indicators:
- Unusual syscall patterns from sandbox containers
- File access attempts outside sandbox boundaries
- Python module import errors or bypass attempts
Network Indicators:
- Unexpected outbound connections from FastGPT sandbox containers
- Unusual data exfiltration patterns
SIEM Query:
container.name="fastgpt-sandbox" AND (syscall="execve" OR syscall="open" OR syscall="write") AND NOT path CONTAINS "/sandbox/"🔗 References
- https://github.com/labring/FastGPT/commit/bb810a43a1c70683fab7f5fe993771e930a94426
- https://github.com/labring/FastGPT/pkgs/container/fastgpt-sandbox
- https://github.com/labring/FastGPT/pull/4958
- https://github.com/labring/FastGPT/releases/tag/v4.9.11
- https://github.com/labring/FastGPT/security/advisories/GHSA-f3pf-r3g7-g895
