TransformerOptimus vulnerabilities
We track 9 vulnerabilities in TransformerOptimus products across 2 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on April 20, 2026.
Latest TransformerOptimus vulnerabilities
- 7.3 High severity
SuperAGI: Improper Limitation of a Pathname to a Restricted Directory
A weakness has been identified in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function Upload of the file superagi/controllers/resources.py of the component Multipart Upload Handler. This manipulation of the argument Name causes pat
- 7.3 High severity
SuperAGI: Improper Authentication
A flaw has been found in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function get_vector_db_details of the file superagi/controllers/vector_dbs.py of the component Vector Database Management Endpoint. Executing a manipulation can le
- 9.8 Critical severity
SuperAGI: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability, which was classified as critical, was found in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function download_attachment of the file SuperAGI/superagi/helper/read_email.py of the component EmailToolKit. The manipulation of the arg
- 8.8 High severity
transformeroptimus/superagi: Improper Control of Generation of Code
SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can l
- 7.5 High severity
transformeroptimus/superagi: Allocation of Resources Without Limits or Throttling
SuperAGI version v0.0.14 is vulnerable to an unauthenticated Denial of Service (DoS) attack. The vulnerability exists in the resource upload request, where appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request causes t
- 8.8 High severity
transformeroptimus/superagi: Unverified Password Change
In version v0.0.14 of transformeroptimus/superagi, there is an improper privilege management vulnerability. After logging into the system, users can change the passwords of other users, leading to potential account takeover.
- 8.8 High severity
transformeroptimus/superagi: Improper Limitation of a Pathname to a Restricted Directory
A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. This vulnerability allows an attacker to upload an arbitrary file to the server, potentially leading to remote code execution or overwriting a
- 8.8 High severity
transformeroptimus/superagi: Authorization Bypass Through User-Controlled Key
An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' informat
- 7.5 High severity
transformeroptimus/superagi: Exposure of Private Personal Information to an Unauthorized Actor
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. An attacker can leak sensitive user information, including names, emails, and passwords, by attempting to register a new account with an email that is already