CVE-2024-8156

Katalog CVE

CVSS 9.8 · Critical EPSS 1,7%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada agpt autogpt classic. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt. The untrusted user input `github.head.ref` is used insecurely, allowing an attacker to inject arbitrary commands. This vulnerability affects versions up to and including the latest version. An attacker can exploit this by creating a branch name with a malicious payload and opening a pull request, potentially leading to reverse shell access or theft of sensitive tokens and keys.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 77,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/significant-gravitas/autogpt/commit/1df7d527dd37dff8363dc162fb58d300f072e302 patch
• https://huntr.com/bounties/959efe87-f109-4cef-94d8-90ff2c7aef51 exploit