CVE-2025-49131 is a medium severity flaw (CVSS 6.3) in the fastgpt-sandbox component of FastGPT before version 4.9.11. The sandbox allows too many system calls, so code running in it can read and overwrite files and bypass import limits. Upgrade to 4.9.11 or later.
What's affected
FastGPT is an open source platform for building AI workflows and conversational agents. The sandbox container, fastgpt-sandbox, runs user submitted or generated code in isolation. The record says versions of the sandbox before 4.9.11 are affected. The GitHub advisory lists the npm package FastGPT/sandbox with affected versions below 4.9.11 and a patched version of 4.9.11.
The advisory describes the sandbox as built on seccomp, a Linux feature that limits which system calls a process may make, using an allowlist. The problem is that the list was too generous.
The record says the fix in 4.9.11 restricts the allowed system calls to a safer subset and adds more descriptive error messages.
How to check if you're exposed
First check whether you run the sandbox at all. It ships as a container image. List running containers and their tags:
docker ps --format "{{.Names}} {{.Image}}" | grep -i fastgpt-sandbox
If the tag is below 4.9.11, you are in the affected range. In Kubernetes, look at the image field of your sandbox deployment instead. If you use a tag such as latest, check which version it resolves to by looking at the image digest and the project's releases.
Then consider who can submit code to your FastGPT workflows. The CVSS vector lists low privileges required. If only trusted staff build flows, the exposure is smaller than on a deployment that lets many users author code blocks.
What to do now
- Find every FastGPT deployment and the sandbox image tag it uses.
- Upgrade the sandbox to 4.9.11 or later, and pull the image again instead of reusing a cached one.
- Run the sandbox container with the fewest rights possible, no mounted secrets, and a read only file system where the product allows it.
- Keep the sandbox on a separate network segment with no route to internal databases.
- Limit which users may add or edit code execution steps in a workflow.
Why it matters
The record files this as CWE-732, incorrect permission assignment for a critical resource. A sandbox is a promise that code inside cannot touch what is outside. When the allowlist includes calls that touch the file system freely, the promise breaks, and the code can read or overwrite files in the container and get around module restrictions meant to keep it contained.
AI workflow tools make this risk practical, because they run code that people or models write on the fly. Treat every sandbox as a layer that can fail, and put a second boundary around it. This CVE is not on the CISA Known Exploited Vulnerabilities list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the main FastGPT app affected too?
The record is about the sandbox component, fastgpt-sandbox. The advisory lists 4.9.11 as the patched version, so update the sandbox image and check the release notes for the rest of your stack.
What does a syscall allowlist do?
It limits which operating system calls a process can make. Shortening the list reduces what hostile code can do even if it runs.
Sources
Last reviewed: 18 October 2026.
