| Package | Affected versions | Patched versions |
|---|---|---|
| fastgpt | < 4.14.10.3 | 4.14.10.3 |
FastGPT is an AI Agent building platform. Prior to 4.14.10.3, the /api/core/app/mcpTools/runTool endpoint accepts arbitrary URLs without authentication. The internal IP check in isInternalAddress() only blocks private IPs when CHECK_INTERNAL_IP=true, which is not the default. This allows unauthenticated attackers to perform SSRF against internal network resources. This vulnerability is fixed in 4.14.10.3.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free