CVE-2025-52552

FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable to open redirect and DOM-based XSS. Improper validation and lack of sanitization of this parameter allows attackers execute malicious JavaScript or redirect them to attacker-controlled sites. This issue has been patched in version 4.9.12.

CVSS

No CVSS.

References

Link	Resource
https://github.com/labring/FastGPT/commit/095b75ee27746004106eddeaa4840688a61ff6eb
https://github.com/labring/FastGPT/security/advisories/GHSA-r976-rfrv-q24m

Configurations

No configuration.

History

23 Jun 2025, 20:16

Type	Values Removed	Values Added
Summary		(es) FastGPT es una plataforma para crear agentes de IA. Antes de la versión 4.9.12, el parámetro LastRoute de la página de inicio de sesión era vulnerable a redireccionamientos abiertos y XSS basado en DOM. La validación incorrecta y la falta de depuración de este parámetro permiten a los atacantes ejecutar JavaScript malicioso o redirigirlos a sitios controlados por ellos. Este problema se ha corregido en la versión 4.9.12.

21 Jun 2025, 03:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-21 03:15

Updated : 2025-06-23 20:16

NVD link : CVE-2025-52552

Mitre link : CVE-2025-52552

CVE.ORG link : CVE-2025-52552

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2025-52552", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-06-21T03:15:24.990", "references": [{"url": "https://github.com/labring/FastGPT/commit/095b75ee27746004106eddeaa4840688a61ff6eb", "source": "security-advisories@github.com"}, {"url": "https://github.com/labring/FastGPT/security/advisories/GHSA-r976-rfrv-q24m", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable to open redirect and DOM-based XSS. Improper validation and lack of sanitization of this parameter allows attackers execute malicious JavaScript or redirect them to attacker-controlled sites. This issue has been patched in version 4.9.12."}, {"lang": "es", "value": "FastGPT es una plataforma para crear agentes de IA. Antes de la versi\u00f3n 4.9.12, el par\u00e1metro LastRoute de la p\u00e1gina de inicio de sesi\u00f3n era vulnerable a redireccionamientos abiertos y XSS basado en DOM. La validaci\u00f3n incorrecta y la falta de depuraci\u00f3n de este par\u00e1metro permiten a los atacantes ejecutar JavaScript malicioso o redirigirlos a sitios controlados por ellos. Este problema se ha corregido en la versi\u00f3n 4.9.12."}], "lastModified": "2025-06-23T20:16:21.633", "sourceIdentifier": "security-advisories@github.com"}