CVE-2026-33075

CVE-2026-33075 is a high-severity vulnerability affecting FastGPT versions 4.14.8.3 and below, allowing arbitrary code execution and secret exfiltration. The flaw stems from a misconfigured GitHub Actions workflow that uses pull_request_target but processes attacker-controlled code, enabling malicious Dockerfiles to be built and pushed, leading to potential supply chain compromise. With a CVSS score of 8.8, this vulnerability poses a significant risk to confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code, the issue has received critical community attention due to the absence of an official patch.