FastGPT’s Python sandbox is intended to block file writes through static analysis and a seccomp filter that prohibits writes on file descriptor 1 (stdout). The vulnerability allows an attacker to remap stdout to any writable file descriptor using fcntl, and then perform sys.stdout.write(), which still satisfies the seccomp rule write(fd==1). Consequently, the sandbox can create or overwrite arbitrary files inside its container, violating the guardrail and compromising the integrity or confidentiality of data processed by the sandbox.

Vendor: labring. Product: FastGPT. Affected versions: FastGPT 4.14.7 and all earlier releases. Any deployment of these versions is vulnerable due to the file‑write guardrail bypass.

The CVSS score of 6.3 indicates a moderate impact, while the EPSS score of less than 1% shows a low probability of exploitation in the wild; it is not listed in the CISA KEV catalog. The attack scenario requires the ability to execute arbitrary Python code within the sandbox. By remapping stdout via fcntl, an attacker can write to any file inside the container, thereby persisting data or tampering with critical files. The vector is effectively local or remote with sufficient code‑execution privileges, making the vulnerability exploitable in environments that accept untrusted Python scripts.