All vulnerabilities
CVE-2024-6091GHSA-g84q-54hf-36rgPYSEC-2026-257

agpt: AutoGPT bypass of the shell commands denylist settings

significant-gravitas agptpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 11 Sep 2024. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.82%Chance of exploitation activity in the next 30 days, higher than 56% of CVEs. Scored 26 Oct 2026FIRST EPSS
Fixed in0.5.1Fixed versionCVE List
Published11 Sep 2024Updated 26 Oct 2026CVE List

What fixes it

  • 0.5.1significant-gravitas/autogptCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings. The issue arises when the denylist is configured to block specific commands, such as whoami and /bin/whoami. An attacker can circumvent this restriction by executing commands with a modified path, such as /bin/./whoami, which is not recognized by the denylist.

Text from CVE List

Affected versions 4

  • agpt, pip<= 0.5.1GitHub
  • significant-gravitas/autogptaffected: unspecified before 0.5.1CVE List
  • agpt, PyPIfrom first release, through 0.5.1OSV
  • agpt, PyPI0.2.2OSV

References 6