What’s Vulnerable › Vulnerabilities

CVE-2025-51472

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-07-22 · updated 2026-06-17
• Weakness: CWE-77

Description

Code Injection in AgentTemplate.eval_agent_config in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to execute arbitrary Python code via malicious values in agent template configurations such as the goal, constraints, or instruction field, which are evaluated using eval() without validation during template loading or updates.

Affected products

• TransformerOptimus SuperAGI: 0.0.14

References

• https://github.com/TransformerOptimus/SuperAGI
• https://github.com/TransformerOptimus/SuperAGI/pull/1461
• https://www.gecko.security/blog/cve-2025-51472

Get alerted when CVE-2025-51472 or the next vulnerability affects your stack