{"data":{"id":"62becc77-14cf-4bdf-8168-5922c6480d53","title":"CVE-2026-33075: FastGPT is an AI Agent building platform. In versions 4.14.8.3 and below, the fastgpt-preview-image.yml workflow is…","summary":"FastGPT versions 4.14.8.3 and below have a flaw in the fastgpt-preview-image.yml workflow. It uses pull_request_target, which runs with access to repository secrets, yet checks out code from the pull request author's fork, so any external contributor can achieve arbitrary code execution and secret exfiltration. The workflow also builds and pushes Docker images from attacker-controlled Dockerfiles, which enables a supply chain attack via the production container registry.","solution":"A patch was not available at the time of publication.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33075","publishedAt":"2026-03-20T09:16:15.877Z","cveId":"CVE-2026-33075","cweIds":["CWE-494","CWE-829"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["FastGPT"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"FastGPT workflow code execution and secret exfiltration by external contributors","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00302,"epssCheckedAt":"2026-11-04T06:10:15.563Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T18:10:55.102Z","patchAvailable":null,"disclosureDate":"2026-03-20T09:16:15.877Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-437"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}