| शीर्षक | Labring FastGPT 4.10.0/4.14.0 SQL Injection |
|---|
| विवरण | The affected product is https://github.com/labring/FastGPT, which has 29.5K stars as of now. The affected version range is `>= 4.10.0` and `<= 4.14.0`. The `POST /api/core/chat/getHistories` endpoint contains a **NoSQL injection** vulnerability. An **unauthenticated** attacker can inject NoSQL operators (`$ne`, `$regex`, `$gt`, etc.) via a crafted JSON payload to bypass the outLink permission check, thereby gaining **unauthorized access to the chat history titles of all users across the entire platform** |
|---|
| स्रोत | ⚠️ https://github.com/ExploreIO/CVE-2026-79483-FastGPT-NoSQL-Injection |
|---|
| उपयोगकर्ता | exploreio (UID 100892) |
|---|
| सबमिशन | 30/08/2026 12:44 PM (24 दिन पहले) |
|---|
| संयम | 22/09/2026 07:27 PM (23 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 397465 [Labring FastGPT Community Edition तक 4.14.0 Chat History getHistories दूरस्थ कोड निष्पादन] |
|---|
| अंक | 0 |
|---|