CVE-2026-42343— FastGPT: Uncontrolled Resource Consumption leading to Sandbox Exhaustion

FastGPT: Uncontrolled Resource Consumption leading to Sandbox Exhaustion

FastGPT is an AI Agent building platform. In versions 4.14.13 and prior, the code-sandbox component suffers from insufficient resource isolation and uncontrolled resource consumption. The service relies solely on an application-level soft limit (a 500ms polling interval) for memory management and lacks strict OS-level constraints such as cgroups or kernel-level namespaces. This architectural weakness allows attackers to easily bypass memory checks via time-window attacks, or exhaust the entire JavaScript worker pool via concurrent CPU-intensive requests, resulting in a complete Denial of Service (DoS) for legitimate users. At time of publication, there are no publicly available patches.

N/A

未加控制的资源消耗(资源穷尽)

FastGPT 资源管理错误漏洞

FastGPT是labring开源的一款基于大语言模型的开源知识库问答系统。 FastGPT 4.14.13及之前版本存在资源管理错误漏洞，该漏洞源于code-sandbox组件资源隔离不足和资源消耗不受控制，可能导致攻击者绕过内存检查或耗尽JavaScript工作线程池。

N/A

N/A