High severity · published Mar 20, 2025
CVE-2025-1040
Server-Side Template Injection (SSTI) in significant-gravitas/autogpt
8.8
CVSS
1.7%
EPSS
No
On KEV
Description
AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote Code Execution (RCE). The vulnerability arises from the improper handling of user-supplied format strings in the `AgentOutputBlock` implementation, where malicious input is passed to the Jinja2 templating engine without adequate security measures. Attackers can exploit this flaw to execute arbitrary commands on the host system. The issue is fixed in version 0.4.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
significant-gravitas/autogpt · significant-gravitas
before v0.4.0 · source: vendor
AP
Autogpt Platform · Agpt
before 0.4.0 · source: NVD
Affected product
SI
significant-gravitas/autogpt
significant-gravitas
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1040
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1040
Patch
https://github.com/significant-gravitas/autogpt/commit/6dba31e0215549604bdcc1aed24e3a1714e75ee2
Exploit
https://huntr.com/bounties/b74ef75f-61d5-4422-ab15-9550c8b4f185
More from significant-gravitas/autogpt
9.8
CVE-2024-8156
Command Injection in significant-gravitas/autogpt
9.8
CVE-2024-6091
Shell Command Denylist Bypass in significant-gravitas/autogpt
9.8
CVE-2024-1881
Improper Neutralization of Special Elements used in an OS Command in significant-gravitas/autogpt
8.8
CVE-2024-1879
CSRF to RCE in significant-gravitas/autogpt
7.8
CVE-2024-1880
OS Command Injection in MacOS Text-To-Speech Class in significant-gravitas/autogpt