Read the docs
TI-2023-18903 Aliases CVE-2023-37273

Docker escape in Auto-GPT when running from docker-compose.yml included in git repo

Priority MEDIUM 40CWE-94Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. Running Auto-GPT version prior to 0.4.3 by cloning the git repo and executing `docker compose run auto-gpt` in the repo root uses a different docker-compose.yml file from the one suggested in the official docker set up instructions. The docker-compose.yml file located in the repo root mounts itself into the docker container without write protection. This means that if malicious custom python code is executed via the `execute_python_file` and `execute_python_code` commands, it can overwrite the docker-compose.yml file and abuse it to gain control of the host system the next time Auto-GPT is started. The issue has been patched in version 0.4.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00358 29th percentileScored 2026-11-07
Fix Fixed Auto-GPT (Significant-Gravitas): 0.4.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Significant-GravitasAuto-GPTbefore 0.4.30.4.3Patch availableCNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:agpt:autogpt_classic:*:*:*:*:*:*:*:*before 0.4.3VulnerableSignificant-Gravitas
  • cpe:2.3:a:agpt:autogpt_classic:*:*:*:*:*:*:*:* Versions before 0.4.3 Vulnerable ·Significant-Gravitas

Remediation

  • Fix · CNA Auto-GPT (Significant-Gravitas) Fixed in 0.4.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-37273

References

Patch 2

  • TI-2024-05646 Shell Command Denylist Bypass in significant-gravitas/autogpt CVSS 3.1CRITICAL 9.8
  • TI-2024-07563 Command Injection in significant-gravitas/autogpt CVSS 3.1CRITICAL 9.8
  • TI-2024-01750 Improper Neutralization of Special Elements used in an OS Command in significant-gravitas/autogpt CVSS 3.1CRITICAL 9.8
  • TI-2024-01748 CSRF to RCE in significant-gravitas/autogpt CVSS 3.1HIGH 8.8
  • TI-2024-01749 OS Command Injection in MacOS Text-To-Speech Class in significant-gravitas/autogpt CVSS 3.1HIGH 7.8
  • TI-2023-18904 Python code execution sandbox escape in non-docker version in Auto-GPT CVSS 3.1HIGH 7.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences