These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-07T22:16:53.930Z and has not been modified since then. The vulnerability affects FastGPT, an open source AI knowledge base platform, specifically versions prior to v4.15.0-beta5. The issue is related to file handlers authorizing an unrelated resource and then signing or reading an S3 object using a [truncated]
CVE-2026-54607 is a high-severity vulnerability in FastGPT's OpenAPI schema importer. An authenticated team member could exploit this issue to read internal services or cloud metadata. The issue was fixed in version 4.15.0-beta4. The vulnerability allows an attacker to access internal services or cloud metadata due to insufficient validation of URLs in the OpenAPI schema importer.
CVE-2026-54602 is a vulnerability in FastGPT, a knowledge-based AI application platform. Prior to version 4.15.0, the platform allows any authenticated user to read another team's prompts, retrieved RAG chunks, and completions if the requestId is known. This issue is fixed in version 4.15.0. The vulnerability exists due to insufficient team scoping in the GET /api/core/ai/record/getRecord endpoint, allowi [truncated]
CVE-2026-54601 is a vulnerability in FastGPT, an open-source AI knowledge base platform. From version 4.14.17 to before 4.15.0-beta4, an authenticated tenant user can call the POST /api/core/dataset/collection/create/reTrainingCollection endpoint in a way that persists a server-owned datasetId value from another tenant. This results in mixed dataset objects, leading to inconsistent ownership anchors for d [truncated]
FastGPT is an AI Agent building platform. Prior to 4.15.0-beta1, the JavaScript sandbox worker at projects/code-sandbox/src/pool/worker.ts:356 blocks dynamic import() with the regex /bimport*s*(/.test(code). JavaScript syntax accepts a block comment between import and (; the regex matches only ASCII whitespace, and the bytes /, *, *, / are not in the s character class. The payload import/**/(child_process [truncated]
FastGPT is an AI Agent building platform. Prior to 4.15.0-beta1, a Server-Side Request Forgery (SSRF) vulnerability allows an authenticated attacker to bypass the global isInternalAddress network protection and make arbitrary HTTP GET requests to internal network services. This is achieved by exploiting an incomplete fix in the dataset preview endpoint /api/core/dataset/file/getPreviewChunks when utilizin [truncated]