CVE-2026-33075

The fastgpt-preview-image.yml workflow uses the pull_request_target trigger, which executes in the context of the base repository with access to its secrets. Simultaneously, source code is retrieved from the pull request author's fork, meaning an attacker can provide their own malicious Dockerfile. The Docker image building and publishing process is performed using a file controlled by the attacker, allowing execution of arbitrary commands in the CI/CD environment and interception of repository secrets. Additionally, since the built image is pushed to a production container registry, a supply chain attack is possible.

An attacker can execute arbitrary code in the CI/CD environment, compromise repository secrets (e.g., tokens, API keys), and introduce a malicious image into the production container registry, potentially compromising the entire software supply chain.

At the time of vulnerability publication, a patch was not available. It is recommended to monitor the official FastGPT project repository and security advisory at https://github.com/labring/FastGPT/security/advisories/GHSA-xfx8-w35j-485c for patch availability information. As interim measures, consider restricting pull request submissions from external contributors or disabling the vulnerable workflow until a patch is released.

FastGPT (Fastgpt platform) versions 4.14.8.3 and earlier