CVE-2025-49131: FastGPT sandbox escape through overly permissive syscalls

Summary

FastGPT's Sandbox container (fastgpt-sandbox), which runs user-submitted or dynamically generated code, has insufficient isolation and overly permissive syscalls before version 4.9.11. Attackers can exploit this to escape the sandbox, read and overwrite arbitrary files, and bypass Python module import restrictions.

Mitigation

Fixed in version 4.9.11, which restricts the allowed system calls to a safer subset and adds more descriptive error messaging.

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online