CVE-2024-1879: fallo de gravedad alta en significant-gravitas/autogpt
CSRF to RCE in significant-gravitas/autogpt
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.5%
A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT server. The vulnerability stems from the lack of protections on the API endpoint receiving instructions, enabling an attacker to direct a user running AutoGPT in their local network to a malicious website. This site can then send crafted requests to the AutoGPT server, leading to command execution. The issue is exacerbated by CORS being enabled for arbitrary origins by default, allowing the attacker to read the response of all cross-site queries. This vulnerability was addressed in version 5.1.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
significant-gravitas · significant-gravitas/autogptCVEs relacionadas — significant-gravitas/autogpt
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-1040HIGHServer-Side Template Injection (SSTI) in significant-gravitas/autogptEPSS 1.7%CVE-2024-8156HIGHCommand Injection in significant-gravitas/autogptEPSS 1.7%CVE-2024-1881HIGHImproper Neutralization of Special Elements used in an OS Command in significant-gravitas/autogptEPSS 1.4%CVE-2024-1880HIGHOS Command Injection in MacOS Text-To-Speech Class in significant-gravitas/autogptEPSS 1.0%CVE-2024-6091CRITICALShell Command Denylist Bypass in significant-gravitas/autogptEPSS 0.8%CVE-2025-0454HIGHSSRF Check Bypass in Requests Utility in significant-gravitas/autogptEPSS 0.6%