CVE-2025-32393 is a high-severity denial-of-service (DoS) vulnerability in Significant-Gravitas AutoGPT versions prior to autogpt-platform-beta-v0.6.32. The flaw exists in the ReadRSSFeedBlock component, where the feedparser.parser processes user-supplied XML feeds without limits on parsing time or resource allocation. An attacker can craft deeply nested or complex XML payloads that exhaust memory resources, causing the application to crash or become unresponsive. This vulnerability requires no authentication or user interaction and can be exploited remotely over the network. Although no known exploits are currently in the wild, the CVSS 8.7 score reflects the ease of exploitation and high impact on availability. The issue has been patched in version 0.
CVE-2025-62616 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting Significant-Gravitas AutoGPT versions prior to autogpt-platform-beta-v0.6.34. The flaw arises from unfiltered user input URLs passed directly to aiohttp. ClientSession(). get in the SendDiscordFileBlock function, allowing attackers to induce the server to make arbitrary HTTP requests. This vulnerability requires no authentication or user interaction and can lead to high confidentiality and integrity impacts by enabling internal network scanning, data exfiltration, or interaction with internal services. The issue has been patched in version 0.6.34.
CVE-2025-62615 is a critical Server-Side Request Forgery (SSRF) vulnerability in Significant-Gravitas AutoGPT versions prior to autogpt-platform-beta-v0.6.34. The issue arises from the unfiltered use of urllib.request.urlopen in the RSSFeedBlock component, allowing attackers to craft malicious URLs that the server will fetch. This can lead to unauthorized internal network access and potential data exposure. The vulnerability requires no authentication or user interaction and has a CVSS 4.0 score of 9.3, indicating high impact on confidentiality and integrity.
CVE-2026-22038 is a high-severity vulnerability in Significant-Gravitas AutoGPT versions prior to autogpt-platform-beta-v0.6.46. The issue involves the insertion of sensitive information, specifically API keys and authentication secrets, into log files in plaintext via logger.info() calls within three Stagehand integration blocks. This exposure can lead to confidentiality breaches and potential denial of service due to availability impact. The vulnerability requires network access and low privileges but no user interaction, making exploitation feasible in many environments. The flaw has been patched in version 0.6.46.
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.44, AutoGPT Platform's block execution endpoints (both main web API and external API) allow executing blocks by UUID without checking the `disabled` flag. Any authenticated user can execute the disabled `BlockInstallationBlock`, which writes arbitrary Python code to the server filesystem and executes it via `__import__()`, achieving Remote Code Execution. In default self-hosted deployments where Supabase signup is enabled, an attacker can self-register; if signup is disabled (e.g., hosted), the attacker needs an existing account.autogpt-platform-beta-v0.6.44 contains a fix.
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents. In v0.6.15 and below, the external API's get_graph_execution_results endpoint has an authorization bypass vulnerability. While it correctly validates user access to the graph_id, it fails to verify ownership of the graph_exec_id parameter, allowing authenticated users to access any execution results by providing arbitrary execution IDs. The internal API implements proper validation for both parameters. This is fixed in v0.6.16.
AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote Code Execution (RCE). The vulnerability arises from the improper handling of user-supplied format strings in the `AgentOutputBlock` implementation, where malicious input is passed to the Jinja2 templating engine without adequate security measures. Attackers can exploit this flaw to execute arbitrary commands on the host system. The issue is fixed in version 0.4.0.
A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt. The untrusted user input `github.head.ref` is used insecurely, allowing an attacker to inject arbitrary commands. This vulnerability affects versions up to and including the latest version. An attacker can exploit this by creating a branch name with a malicious payload and opening a pull request, potentially leading to reverse shell access or theft of sensitive tokens and keys.