CVE-2025-49131

{
  "id": "CVE-2025-49131",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-49131",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-09T14:29:59.496605Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "labring",
          "product": "FastGPT",
          "versions": [
            {
              "status": "affected",
              "version": "< 4.9.11"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-06-09T13:15:24.120",
  "references": [
    {
      "url": "https://github.com/labring/FastGPT/commit/bb810a43a1c70683fab7f5fe993771e930a94426",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/labring/FastGPT/pkgs/container/fastgpt-sandbox",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/labring/FastGPT/pull/4958",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/labring/FastGPT/releases/tag/v4.9.11",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/labring/FastGPT/security/advisories/GHSA-f3pf-r3g7-g895",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "FastGPT is an open-source project that provides a platform for building, deploying, and operating AI-driven workflows and conversational agents. The Sandbox container (fastgpt-sandbox) is a specialized, isolated environment used by FastGPT to safely execute user-submitted or dynamically generated code in isolation. The sandbox before version 4.9.11 has insufficient isolation and inadequate restrictions on code execution by allowing overly permissive syscalls, which allows attackers to escape the intended sandbox boundaries. Attackers could exploit this to read and overwrite arbitrary files and bypass Python module import restrictions. This is patched in version 4.9.11 by restricting the allowed system calls to a safer subset and additional descriptive error messaging."
    },
    {
      "lang": "es",
      "value": "FastGPT es un proyecto de código abierto que proporciona una plataforma para crear, implementar y operar flujos de trabajo basados en IA y agentes conversacionales. El contenedor de la Sandbox (fastgpt-sandbox) es un entorno aislado especializado que FastGPT utiliza para ejecutar de forma segura código enviado por el usuario o generado dinámicamente. El entorno de la Sandbox anterior a la versión 4.9.11 presenta un aislamiento insuficiente y restricciones inadecuadas en la ejecución de código, al permitir llamadas al sistema excesivamente permisivas, lo que permite a los atacantes eludir los límites previstos del entorno de la Sandbox. Los atacantes podrían aprovechar esto para leer y sobrescribir archivos arbitrarios y eludir las restricciones de importación de módulos de Python. Esto se ha corregido en la versión 4.9.11, restringiendo las llamadas al sistema permitidas a un subconjunto más seguro y proporcionando mensajes de error descriptivos adicionales."
    }
  ],
  "lastModified": "2026-06-17T09:30:47.883",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fastgpt:fastgpt:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "399B37D5-15EF-4422-A2E4-562945585A87",
              "versionEndExcluding": "4.9.11"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}