System logs spoofable in Auto-GPT via ANSI control sequences
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. The Auto-GPT command line UI makes heavy use of color-coded print statements to signify different types of system messages to the user, including messages that are crucial for the user to review and control which commands should be executed. Before v0.4.3, it was possible for a malicious external resource (such as a website browsed by Auto-GPT) to cause misleading messages to be printed to the console by getting the LLM to regurgitate JSON encoded ANSI escape sequences (`\u001b[`). These escape sequences were JSON decoded and printed to the console as part of the model's "thinking process". The issue has been patched in release version 0.4.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Significant-Gravitas | Auto-GPT | before 0.4.3 | 0.4.3 | Patch available | CNA |
- Auto-GPT VendorSignificant-Gravitas Affected before 0.4.3 Fixed in 0.4.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:agpt:autogpt_classic:*:*:*:*:*:*:*:* | before 0.4.3 | Vulnerable | Significant-Gravitas |
- cpe:2.3:a:agpt:autogpt_classic:*:*:*:*:*:*:*:* Versions before 0.4.3 Vulnerable ·Significant-Gravitas
Remediation
- Fix · CNA Auto-GPT (Significant-Gravitas) Fixed in 0.4.3
Timeline
- 2026-10-02 Threatist record created from CVE-2023-37275
References
More Significant-Gravitas Autogpt Classic vulnerabilities
- TI-2024-05646 Shell Command Denylist Bypass in significant-gravitas/autogpt CVSS 3.1CRITICAL 9.8
- TI-2024-07563 Command Injection in significant-gravitas/autogpt CVSS 3.1CRITICAL 9.8
- TI-2024-01750 Improper Neutralization of Special Elements used in an OS Command in significant-gravitas/autogpt CVSS 3.1CRITICAL 9.8
- TI-2024-01748 CSRF to RCE in significant-gravitas/autogpt CVSS 3.1HIGH 8.8
- TI-2024-01749 OS Command Injection in MacOS Text-To-Speech Class in significant-gravitas/autogpt CVSS 3.1HIGH 7.8
- TI-2023-18903 Docker escape in Auto-GPT when running from docker-compose.yml included in git repo CVSS 3.1HIGH 8.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences