CVE-2026-55237

Katalog CVE

CVSS 8.8 · High EPSS 0,32%

Kerentanan Improper Neutralization of Alternate XSS Syntax. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions prior to 0.6.62 have a DOM-based Cross-Site Scripting (XSS) vulnerability in AutoGPT's signup page. The application improperly trusts a URL parameter (`next`), which is passed to `router.push`. An attacker can craft a malicious link that, when opened by an authenticated user, performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. Version 0.6.62 patches the issue.

Rincian

Terbit di NVD

18 Juni 2026

Terakhir diubah

18 Juni 2026

Status NVD

Deferred

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-87: Improper Neutralization of Alternate XSS Syntax
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-j2cp-jg5q-38wj