Skip to content

RadicalNotion.AI

We do not sell or share your personal information.

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Log in Create an account

Home
Patched Functions
Labring
Fastgpt

labring/FastGPT: Functions Patched by CVE Fixes

typescript

shell

#324 of 500 repositories

labring/FastGPT

Functions and files changed by CVE fixes in this repository.

Latest located fix September 22, 2026

17

CVE fixes located

Published CVEs

162

Functions patched

Distinct function sites

186

Files patched

Distinct source files

2025–2026

Years covered

By CVE publication date

Overview

17 published CVEs have a fix traced to functions in labring/FastGPT, the earliest published in 2025. Those fixes changed 162 distinct functions across 186 files, in 1,080 patch hunks.

Among the 500 repositories tracked here, labring/FastGPT ranks #324 by the number of CVEs with a located fix.

Most patched functions

Functions in labring/FastGPT changed by the most CVE fixes.

1handlerprojects/app/src/pages/api/core/app/mcpTools/runTool.ts3 CVEs · 3 patches2026
2handlerprojects/app/src/pages/api/core/app/mcpTools/getTools.ts3 CVEs · 3 patches2026
3stringpackages/service/env.ts2 CVEs · 3 patches2026
4handlerprojects/app/src/pages/api/core/app/httpTools/runTool.ts2 CVEs · 2 patches2026
5hashStrprojects/app/src/web/support/user/api.ts2 CVEs · 1 patches2026
6asyncprojects/app/src/pages/login/index.tsx2 CVEs · 1 patches2026
7objectpackages/global/openapi/support/user/account/password/api.ts2 CVEs · 1 patches2026
8handlerprojects/app/src/pages/api/support/user/account/updatePasswordByOld.ts2 CVEs · 1 patches2026
9asyncprojects/app/src/pages/chat/index.tsx2 CVEs · 1 patches2026
10onSuccessprojects/app/src/pageComponents/login/LoginForm/WechatForm.tsx2 CVEs · 1 patches2026
11asyncprojects/app/src/pages/login/provider.tsx2 CVEs · 1 patches2026
12defineConfigpackages/service/vitest.config.ts1 CVEs · 2 patches2026
13defineConfigpackages/service/vitest.integration.config.ts1 CVEs · 2 patches2026
14defineConfigprojects/app/vitest.config.ts1 CVEs · 2 patches2026
15handlerprojects/app/src/pages/api/core/app/httpTools/getApiSchemaByUrl.ts1 CVEs · 2 patches2026

Most patched files

Files in labring/FastGPT changed by the most CVE fixes.

1packages/service/core/app/mcp.ts3 CVEs · 5 functions
2projects/app/src/pages/api/core/app/mcpTools/getTools.ts3 CVEs · 3 functions
3projects/app/src/pages/api/core/app/mcpTools/runTool.ts3 CVEs · 3 functions
4packages/service/common/api/axios.ts2 CVEs · 5 functions
5packages/global/support/user/team/type.ts2 CVEs · 4 functions
6packages/service/core/ai/llm/agentLoop/loop/base.ts2 CVEs · 3 functions
7packages/service/core/workflow/dispatch/child/runTool.ts2 CVEs · 3 functions
8packages/global/support/user/type.ts2 CVEs · 2 functions
9packages/service/core/ai/llm/compress/index.ts2 CVEs · 2 functions
10packages/service/core/workflow/dispatch/ai/agent/sub/tool/index.ts2 CVEs · 2 functions

Fix size

How much code a CVE fix in labring/FastGPT changes, with backports counted once.

394

Median lines changed

Added plus removed, per CVE

0%

Fixes of 20 lines or fewer

Share of CVE fixes

0%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in labring/FastGPT, and the functions each fix changed.

FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests
CVE-2026-84301ResolvedAddress HttpMethod SafeAxiosRequestOptions
Medium · CVSS 6.3
EPSS 0.3%2026-09-22
FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization
CVE-2026-68929WechatQrcodeGenerateBodyType WechatQrcodeStatusQueryType WechatLogoutBodyType
Critical · CVSS 9.3
EPSS 0.4%2026-08-27
FastGPT: /api/core/chat/record/getCollectionQuote can disclose cross-tenant dataset text due to an unbound initialId lookup
CVE-2026-61644map AxiosInstance McpFetch
High · CVSS 7.7
EPSS 0.4%2026-07-15
FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token')
CVE-2026-61684defineConfig string
High · CVSS 8.8
EPSS 0.5%2026-07-15
FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord
CVE-2026-54602createQuestionGuide generateSkillMd getSkillGuidance
High · CVSS 7.1
EPSS 0.4%2026-07-07
FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard)
CVE-2026-54607handler FlowNodeOutputItemType
High · CVSS 7.7
EPSS 0.5%2026-07-07
FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)
CVE-2026-55418parseChatFileS3Key parseDatasetFileS3Key parseHelperBotFileS3Key
High · CVSS 8.6
EPSS 0.5%2026-07-07
FastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusion
CVE-2026-54601handler UpdateTrainingDataResponse meta
Medium · CVSS 6.3
EPSS 0.4%2026-07-07
FastGPT: Stored MCP tool URL SSRF in FastGPT workflow execution
CVE-2026-44284handler MCPClient getSecretValue
Medium · CVSS 6.3
EPSS 0.4%2026-05-08
FastGPT: Unauthenticated Remote Code Execution (RCE) via code-server Misconfiguration in agent-sandbox
CVE-2026-42302CsSession fetchCodeServerPassword deleteProxySession
Critical · CVSS 9.8
EPSS 1.3%2026-05-08
FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover
CVE-2026-40352LoginSuccessResponseType object hashStr
High · CVSS 8.8
EPSS 0.5%2026-04-17
FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass
CVE-2026-40351LoginSuccessResponseType object hashStr
Critical · CVSS 9.8
EPSS 0.6%2026-04-17

Get an alert for each new labring/FastGPT CVE, with the patched functions and AI-written analysis.

Monitor FastGPT CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

alkacon/opencms-core17 CVEs apache/zeppelin17 CVEs cgit.ghostscript.com/cgi-bin-cgit.cgi-ghostpdl17 CVEs ChurchCRM/CRM17 CVEs coturn/coturn17 CVEs cure53/DOMPurify17 CVEs debian/gnutls2817 CVEs debian/xen17 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in labring/FastGPT.

How many CVEs have a located fix in labring/FastGPT?: 17 published CVEs have a fix traced to functions in labring/FastGPT, touching 162 functions across 186 files.
Which function in labring/FastGPT has been patched by the most CVEs?: handler in projects/app/src/pages/api/core/app/mcpTools/runTool.ts has been changed by 3 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in labring/FastGPT?: The median fix changes 394 lines. 0% of fixes change 20 lines or fewer, and 0% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

labring/FastGPT on GitHub (opens in a new tab)
Patched functions directory
CWE directory: the weakness types behind these fixes

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track labring/FastGPT CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing

On this page

Overview
Most patched functions
Most patched files
Fix size
Latest CVEs
Other repositories
FAQ
References