CVE-2026-44287 FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*\(/ is bypassable
Attackers can bypass sandbox restrictions to execute arbitrary commands via dynamic import injection in FastGPT.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44287?
CVE-2026-44287 is a medium-severity code injection vulnerability in labring FastGPT, published on 29 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
FastGPT is an AI Agent building platform. Prior to 4.15.0-beta1, the JavaScript sandbox worker at projects/code-sandbox/src/pool/worker.ts:356 blocks dynamic import() with the regex /\bimport\s*\(/.test(code). JavaScript syntax accepts a block comment between import and (; the regex matches only ASCII whitespace, and the bytes /, *, *, / are not in the \s character class. The payload import/**/("child_process") parses as a syntactically valid dynamic import that the regex does not detect. Because import() is not wrapped by the safeRequire Proxy (which only proxies require), the attacker loads child_process and calls execSync - arbitrary command execution as uid=100(sandbox) inside the sandbox container. This vulnerability is fixed in 4.15.0-beta1.
Which versions are affected by CVE-2026-44287?
How do I fix CVE-2026-44287?
No fix has been published for CVE-2026-44287 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-44287 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44287 exists.
Sources
Also known as GHSA-f5mq-qxm4-5mvc.