CVE-2024-1879— CSRF to RCE in significant-gravitas/autogpt
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-1879
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CSRF to RCE in significant-gravitas/autogpt
Source: NVD (National Vulnerability Database)
Vulnerability Description
A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT server. The vulnerability stems from the lack of protections on the API endpoint receiving instructions, enabling an attacker to direct a user running AutoGPT in their local network to a malicious website. This site can then send crafted requests to the AutoGPT server, leading to command execution. The issue is exacerbated by CORS being enabled for arbitrary origins by default, allowing the attacker to read the response of all cross-site queries. This vulnerability was addressed in version 5.1.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
跨站请求伪造(CSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Title
AutoGPT 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
AutoGPT是一个用于便捷使用AI工具的工具。 AutoGPT 0.5.0 版本存在跨站请求伪造漏洞，该漏洞源于接收指令的API端点缺乏保护，从而导致攻击者可在AutoGPT服务器上执行任意命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| significant-gravitas | significant-gravitas/autogpt | unspecified ~ 5.1 | - |
II. Public POCs for CVE-2024-1879
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-1879
请登录查看更多情报信息。
Same Patch Batch · significant-gravitas · 2024-06-06 · 3 CVEs total
| CVE-2024-1880 | OS Command Injection in MacOS Text-To-Speech Class in significant-gravitas/autogpt | |
| CVE-2024-1881 | Improper Neutralization of Special Elements used in an OS Command in significant-gravitas/ |
IV. Related Vulnerabilities
Same product: significant-gravitas/autogpt
- CVE-2024-10457
SSRF Vulnerabilities in significant-gravitas/autogpt - CVE-2025-0454
SSRF Check Bypass in Requests Utility in significant-gravita - CVE-2025-1040
Server-Side Template Injection (SSTI) in significant-gravita - CVE-2024-8156
Command Injection in significant-gravitas/autogpt - CVE-2024-6091
Shell Command Denylist Bypass in significant-gravitas/autogp
Same vendor: significant-gravitas
- CVE-2026-26020
AutoGPT Affected by Remote Code Execution via Dynamic Module - CVE-2026-26006
Redos (Regular Expression Denial of Service) at Code Extract - CVE-2025-32393
AutoGPT has a DoS vulnerability in ReadRSSFeedBlock - CVE-2025-62616
AutoGPT has SSRF vulnerability in SendDiscordFileBlock - CVE-2025-62615
AutoGPT has SSRF vulnerability in ReadRSSFeedBlock
Same weakness: CWE-352
- CVE-2021-47953
OpenCart 3.0.3.7 Cross-Site Request Forgery via account/pass - CVE-2021-47946
OpenCart 3.0.3.6 Account Takeover via Cross Site Request For - CVE-2022-50955
WordPress Plugin Curtain 1.0.2 Cross-site Request Forgery - CVE-2026-8194
osTicket Dispatcher class.dispatcher.php cross-site request - CVE-2026-42286
Emlog: Cross-Site Request Forgery in Admin Functions
V. Comments for CVE-2024-1879
No comments yet