CVE-2024-8156: fallo de gravedad alta en significant-gravitas/autogpt
Command Injection in significant-gravitas/autogpt
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 1.7%
A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt. The untrusted user input `github.head.ref` is used insecurely, allowing an attacker to inject arbitrary commands. This vulnerability affects versions up to and including the latest version. An attacker can exploit this by creating a branch name with a malicious payload and opening a pull request, potentially leading to reverse shell access or theft of sensitive tokens and keys.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
significant-gravitas · significant-gravitas/autogptCVEs relacionadas — significant-gravitas/autogpt
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-1040HIGHServer-Side Template Injection (SSTI) in significant-gravitas/autogptEPSS 1.7%CVE-2024-1881HIGHImproper Neutralization of Special Elements used in an OS Command in significant-gravitas/autogptEPSS 1.4%CVE-2024-1880HIGHOS Command Injection in MacOS Text-To-Speech Class in significant-gravitas/autogptEPSS 1.0%CVE-2024-6091CRITICALShell Command Denylist Bypass in significant-gravitas/autogptEPSS 0.8%CVE-2025-0454HIGHSSRF Check Bypass in Requests Utility in significant-gravitas/autogptEPSS 0.6%CVE-2024-10457MEDIUMSSRF Vulnerabilities in significant-gravitas/autogptEPSS 0.6%