FastGPT (labring:FastGPT) is a knowledge‑based AI application platform. Until commit 22ebfacbb43311e9b73294040ae0eb87390c6bba, artifacts are built from untrusted pull‑request code in the ".github/workflows/preview‑docs‑build.yml" and ".github/workflows/preview‑fastgpt‑build.yml" files. These artifacts can be downloaded by privileged workflow_run jobs defined in ".github/workflows/preview‑docs‑push.yml" and ".github/workflows/preview‑fastgpt‑push.yml". As a result, an attacker who controls the pull request can create Docker images that are automatically pushed to GitHub Container Registry and, for documentation previews, deployed into the target cluster using the secrets.KUBE_CONFIG_CN Kubernetes configuration. The attacker therefore achieves remote code execution inside the container runtime through the automated preview workflow.

The vulnerable component is the FastGPT platform as maintained by labring. Versions up to and including commit 22ebfacbb43311e9b73294040ae0eb87390c6bba are affected. No specific release numbers are provided beyond this commit marker.

The CVSS score of 9.3 indicates a high severity vulnerability. The EPSS score is less than 1%, suggesting the probability of exploitation is currently low but non‑zero. The vulnerability is not listed in CISA's KEV catalog. Attackers can exercise the malicious path by submitting a pull request containing a malicious Dockerfile, then triggering a preview workflow that uses the untrusted artifact. If the workflow has privileged status, the attacker’s image is automatically pushed and deployed, giving remote code execution within the target environment.