significant-gravitas/autogpt vulnerabilities
7 known vulnerabilities in significant-gravitas/autogpt from Significant-Gravitas. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
significant-gravitas/autogpt: Improper Neutralization of Special Elements Used in a Template Engine
AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote Code Execution (RCE). The vulnerability arises from the improper handling of user-supplied format strings in the `AgentOutputBlock` implement
- 7.5 High severity
significant-gravitas/autogpt: Server-Side Request Forgery
A Server-Side Request Forgery (SSRF) vulnerability was identified in the Requests utility of significant-gravitas/autogpt versions prior to v0.4.0. The vulnerability arises due to a hostname confusion between the `urlparse` function from the `urllib.parse` lib
- 9.8 Critical severity
significant-gravitas/autogpt: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt. The untrusted user input `github.head.ref` is used insecurely, allowing an attacker to inject arbitrary commands. This vulnerability affects versions
- 9.8 Critical severity
significant-gravitas/autogpt: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings. The issue arises when the denylist is configured to block specific commands, such as 'whoami' and '/bin/whoami'. An attacker can ci
- 9.8 Critical severity
significant-gravitas/autogpt: Improper Neutralization of Special Elements used in an OS Command
AutoGPT, a component of significant-gravitas/autogpt, is vulnerable to an improper neutralization of special elements used in an OS command ('OS Command Injection') due to a flaw in its shell command validation function. Specifically, the vulnerability exists
- 7.8 High severity
significant-gravitas/autogpt: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in the MacOS Text-To-Speech class MacOSTTS of the significant-gravitas/autogpt project, affecting versions up to v0.5.0. The vulnerability arises from the improper neutralization of special elements used in an OS co
- 8.8 High severity
significant-gravitas/autogpt: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT server. The vulnerability stems from the lack of protections on the API endpoint receiving instructio