Advisories · Technology
Significant-Gravitas AutoGPT.
Every CVE that names Significant-Gravitas AutoGPT among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.2 High
AutoGPT: Webhook provider path confusion bypasses generic webhook secret verification
- Significant-Gravitas AutoGPT
- Authentication bypass
- CVSS 5.3 Medium
AutoGPT: There is a DoS vulnerability in AITextSummarizerBlock
- Significant-Gravitas AutoGPT
- Denial of service
- CWE-405
- CVSS 5.3 Medium
AutoGPT: There is a DoS vulnerability in ExtractTextInformationBlock
- Significant-Gravitas AutoGPT
- Denial of service
- CVSS 8.5 High
AutoGPT: SSRF-to-RCE Chain in `SendWebRequestBlock` via IP validation bypass and internal `pg-meta` access
- Significant-Gravitas AutoGPT
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
AutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping Triggering
- Significant-Gravitas AutoGPT
- Broken access control
- CVSS 7.7 High
AutoGPT: Denial of Service (DoS) via Resource Exhaustion in text templating features
- Significant-Gravitas AutoGPT
- Denial of service
- CVSS 8.8 High
AutoGPT SignUp Page has DOM-Based XSS and Open Redirect
- Significant-Gravitas AutoGPT
- Cross-site scripting (XSS)
- Open redirect
- CVSS 8.7 High
AutoGPT has a DoS vulnerability in MediaDurationBlock
- Significant-Gravitas AutoGPT
- Denial of service
- CVSS 7.1 High
AutoGPT has a DoS vulnerability in AddAudioToVideoBlock
- Significant-Gravitas AutoGPT
- Denial of service
- CVSS 8.7 High
AutoGPT has a DoS vulnerability in ScreenshotWebPageBlock
- Significant-Gravitas AutoGPT
- Denial of service
- CVSS 8.7 High
AutoGPT has a DoS vulnerability in FileStoreBlock with StepThroughItemsBlock
- Significant-Gravitas AutoGPT
- Denial of service
- CVSS 8.7 High
AutoGPT has a DoS vulnerability in LoopVideoBlock
- Significant-Gravitas AutoGPT
- Denial of service
- CVSS 5.4 Medium
AutoGPT: Credit system bypassed via direct block execution in POST /api/blocks/{block_id}/execute
- Significant-Gravitas AutoGPT
- Denial of service
- CWE-841
- CVSS 5.0 Medium
AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server
- Significant-Gravitas AutoGPT
- Server-side request forgery (SSRF)
- CVSS 7.6 High
AutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries
- Significant-Gravitas AutoGPT
- Code injection
- Insecure deserialization
- CVSS 7.5 High
AutoGPT: Unauthenticated DoS via Disk Space Exhaustion
- Significant-Gravitas AutoGPT
- Denial of service
- CWE-459
- CVSS 7.1 High
AutoGPT has Authenticated Session Hijacking via IDOR
- Significant-Gravitas AutoGPT
- Broken access control
- CVSS 5.1 Medium
AutoGPT has missing Docker log rotation on platform containers that allows host disk-exhaustion DoS
- Significant-Gravitas AutoGPT
- Denial of service
- CVSS 9.4 CriticalCritical · CVSS 9+
AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__)
- Significant-Gravitas AutoGPT
- Broken access control
- CVSS 6.5 Medium
Redos (Regular Expression Denial of Service) at Code Extraction Block in significant-gravitas/autogpt
- Significant-Gravitas AutoGPT
- Denial of service
- CVSS 8.7 High
AutoGPT has a DoS vulnerability in ReadRSSFeedBlock
- Significant-Gravitas AutoGPT
- Denial of service
- CVSS 9.3 CriticalCritical · CVSS 9+
AutoGPT has SSRF vulnerability in SendDiscordFileBlock
- Significant-Gravitas AutoGPT
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
AutoGPT has SSRF vulnerability in ReadRSSFeedBlock
- Significant-Gravitas AutoGPT
- Server-side request forgery (SSRF)
- CVSS 8.1 High
AutoGPT's API Keys and Secrets Logged in Plaintext in Stagehand Integration Blocks
- Significant-Gravitas AutoGPT
- Information disclosure
- CVSS 7.7 High
AutoGPT Platform Exposes Graph Execution Results via Authorization Gap
- Significant-Gravitas AutoGPT
- Broken access control
- CVSS 3.5 Low
AutoGPT allows cross-user sharing of node execution results through WebSockets API
- Significant-Gravitas AutoGPT
- Information disclosure
- Broken access control
- CVSS 8.6 High
AutoGPT allows leakage of cross-domain cookies and protected headers in requests redirect
- Significant-Gravitas AutoGPT
- Information disclosure
- CVSS 7.5 High
AutoGPT allows SSRF due to DNS Rebinding in requests wrapper
- Significant-Gravitas AutoGPT
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
SSRF Vulnerabilities in significant-gravitas/autogpt
- significant-gravitas/autogpt
- Server-side request forgery (SSRF)
- CVSS 7.5 High
SSRF Check Bypass in Requests Utility in significant-gravitas/autogpt
- significant-gravitas/autogpt
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Server-Side Template Injection (SSTI) in significant-gravitas/autogpt
- significant-gravitas/autogpt
- Code injection
- CVSS 8.8 High
Command Injection in significant-gravitas/autogpt
- significant-gravitas/autogpt
- Command injection
- CVSS 7.7 High
AutoGPT SSRF vulnerability
- Significant-Gravitas AutoGPT
- Server-side request forgery (SSRF)
- CVSS 7.8 High
OS Command Injection in MacOS Text-To-Speech Class in significant-gravitas/autogpt
- significant-gravitas/autogpt
- Command injection
- CVSS 8.8 High
Improper Neutralization of Special Elements used in an OS Command in significant-gravitas/autogpt
- significant-gravitas/autogpt
- Command injection
- CVSS 8.8 High
CSRF to RCE in significant-gravitas/autogpt
- significant-gravitas/autogpt
- Cross-site request forgery (CSRF)