What’s Vulnerable › Vulnerabilities

CVE-2024-10457: SSRF Vulnerabilities in significant-gravitas/autogpt

• Severity: medium (CVSS 6.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-20 · updated 2026-06-17
• Weakness: CWE-918

Description

Multiple Server-Side Request Forgery (SSRF) vulnerabilities were identified in the significant-gravitas/autogpt repository, specifically in the GitHub Integration and Web Search blocks. These vulnerabilities affect version agpt-platform-beta-v0.1.1. The issues arise when block inputs are controlled by untrusted sources, leading to potential credential leakage, internal network scanning, and unauthorized access to internal services, APIs, or data stores. The affected blocks include GithubListPullRequestsBlock, GithubReadPullRequestBlock, GithubAssignPRReviewerBlock, GithubListPRReviewersBlock, GithubUnassignPRReviewerBlock, GithubCommentBlock, GithubMakeIssueBlock, GithubReadIssueBlock, GithubListIssuesBlock, GithubAddLabelBlock, GithubRemoveLabelBlock, GithubListBranchesBlock, and ExtractWebsiteContentBlock.

Affected products

• significant-gravitas/autogpt: before autogpt-platform-beta-v0.2.1 — fixed in autogpt-platform-beta-v0.2.1

How to fix

Upgrade to a fixed version: significant-gravitas/autogpt autogpt-platform-beta-v0.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/significant-gravitas/autogpt/commit/bcaf3241dadfc1fca024e91fb8f2e3004105a172
• https://huntr.com/bounties/1d91e1e1-7d45-4bda-bc27-bfe9052fd975

Get alerted when CVE-2024-10457 or the next vulnerability affects your stack