File Write Bypass in FastGPT's Python Sandbox

CVE-2026-32128

What is CVE-2026-32128?

The FastGPT platform includes a Python Sandbox that is designed to enforce guardrails curbing file write operations. However, versions prior to 4.14.7 are susceptible to a significant security vulnerability where an attacker can bypass these restrictions. By remapping the standard output (stdout) to an arbitrary writable file descriptor through the use of the fcntl system call, unauthorized file writes can occur. This enables the creation or overwriting of files within the sandbox environment, undermining the intended protective measures put in place to prevent such actions.

References