TI-2024-07563 Aliases CVE-2024-8156 GHSA-rrfw-qqmx-gqwx

Command Injection in significant-gravitas/autogpt

HIGH 76CWE-77Published 2025-03-20 · Updated 2025-10-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.

Summary

A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt. The untrusted user input `github.head.ref` is used insecurely, allowing an attacker to inject arbitrary commands. This vulnerability affects versions up to and including the latest version. An attacker can exploit this by creating a branch name with a malicious payload and opening a pull request, potentially leading to reverse shell access or theft of sensitive tokens and keys.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01742 77th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed significant-gravitas/autogpt (significant-gravitas): 0.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Significant-Gravitas	significant-gravitas/autogpt	before 0.5.1	0.5.1	Patch available	CNA

significant-gravitas/autogpt VendorSignificant-Gravitas Affected before 0.5.1 Fixed in 0.5.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:agpt:autogpt_classic::::::::	before 0.5.1	Vulnerable	Significant-Gravitas

cpe:2.3:a:agpt:autogpt_classic:*:*:*:*:*:*:*:* Versions before 0.5.1 Vulnerable ·Significant-Gravitas

Remediation

Fix · CNA significant-gravitas/autogpt (significant-gravitas) Fixed in 0.5.1

Timeline

2026-10-02 Threatist record created from CVE-2024-8156
2026-10-03 Alias added: GHSA-rrfw-qqmx-gqwx

References

Exploit 1

https://huntr.com/bounties/959efe87-f109-4cef-94d8-90ff2c7aef51

Patch 1

https://github.com/significant-gravitas/autogpt/commit/1df7d527dd37dff8363dc162fb58d300f072e302

TI-2024-05646 Shell Command Denylist Bypass in significant-gravitas/autogpt CVSS 3.1CRITICAL 9.8
TI-2024-01750 Improper Neutralization of Special Elements used in an OS Command in significant-gravitas/autogpt CVSS 3.1CRITICAL 9.8
TI-2024-01748 CSRF to RCE in significant-gravitas/autogpt CVSS 3.1HIGH 8.8
TI-2024-01749 OS Command Injection in MacOS Text-To-Speech Class in significant-gravitas/autogpt CVSS 3.1HIGH 7.8
TI-2023-18903 Docker escape in Auto-GPT when running from docker-compose.yml included in git repo CVSS 3.1HIGH 8.8
TI-2023-18904 Python code execution sandbox escape in non-docker version in Auto-GPT CVSS 3.1HIGH 7.8

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences