What’s Vulnerable › Vulnerabilities

CVE-2025-32393: AutoGPT has a DoS vulnerability in ReadRSSFeedBlock

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-05 · updated 2026-06-17
• Weakness: CWE-770

Description

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.32, there is a DoS vulnerability in ReadRSSFeedBlock. In RSSBlock, feedparser.parser is called to obtain the XML file according to the URL input by the user, parse the XML, and finally obtain the parsed result. However, during the parsing process, there is no limit on the parsing time and the resources that can be allocated for parsing. When a malicious user lets RSSBlock parse a carefully constructed, deep XML, it will cause memory resources to be exhausted, eventually causing DoS. This issue has been patched in autogpt-platform-beta-v0.6.32.

Affected products

• Significant-Gravitas AutoGPT: before 0.6.32 — fixed in 0.6.32

How to fix

Upgrade to a fixed version: Significant-Gravitas AutoGPT 0.6.32. Check the vendor advisory for mitigations.

References

• https://github.com/Significant-Gravitas/AutoGPT/commit/57a06f70883ce6be18738c6ae8bb41085c71e266
• https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-5cqw-g779-9f9x

Get alerted when CVE-2025-32393 or the next vulnerability affects your stack