FastGPT v4.14.8.3 and earlier have a workflow that uses the pull_request_target trigger, which runs with access to repository secrets, and checks out the code from the pull request author's fork. An attacker can supply a crafted Dockerfile that is built and pushed to the production container registry, granting remote code execution and enabling secret exfiltration. The weakness involves CWE‑494 (Unrestricted Write to File) and CWE‑829 (Improper Restriction of XML External Entity Reference). This flaw allows an external contributor to execute arbitrary code on the CI runner and compromise all secrets exposed to the workflow.

The vulnerability affects the FastGPT platform from labring. Affected software versions are 4.14.8.3 and below. No other products or versions are listed.

The CVSS score is 9.4, indicating critical severity. The EPSS score is less than 1%, suggesting a low probability of exploitation detected in the wild so far, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack vector is publicly available via the GitHub Actions pull_request_target mechanism, meaning that any open pull request can be used by an attacker to trigger the exploit. Once the forked code is merged into the CI pipeline, the attacker can execute arbitrary code and exfiltrate secrets.