CVE-2025-31490 AutoGPT allows SSRF due to DNS Rebinding in requests wrapper

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1, AutoGPT allows SSRF due to DNS Rebinding in requests wrapper. AutoGPT is built with a wrapper around Python's requests library, hardenin...

CVE-2025-31490 AutoGPT allows SSRF due to DNS Rebinding in requests wrapper

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1, AutoGPT allows SSRF due to DNS Rebinding in requests wrapper. AutoGPT is built with a wrapper around Python's requests library, hardenin...

CVE-2025-31490 AutoGPT allows SSRF due to DNS Rebinding in requests wrapper

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1, AutoGPT allows SSRF due to DNS Rebinding in requests wrapper. AutoGPT is built with a wrapper around Python's requests library, hardenin...

CVE-2025-31490

CVE-2025-31490 affects AutoGPT prior to 0.6.1 and is caused by a DNS rebinding flaw in the requests wrapper used to validate hostnames. The wrapper, located at autogpt_platform/backend/backend/util/request.py, attempts to prevent SSRF by rejecting local IPv4/IPv6 resolutions, but a DNS server’s T...

PT-2025-16278 · Autogpt +1 · Autogpt +1

Name of the Vulnerable Software and Affected Versions: AutoGPT versions prior to 0.6.1 Description: The issue allows for the leakage of cross-domain cookies and protected headers in requests redirect. AutoGPT uses a wrapper around the requests python library, which has a fundamental flaw in...

PT-2025-16277 · Autogpt · Autogpt

Name of the Vulnerable Software and Affected Versions: AutoGPT versions prior to 0.6.1 Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability in AutoGPT, which is caused by DNS Rebinding in the requests wrapper. This allows an attacker to bypass the validation of th...

AutoGPT 信息泄露漏洞

AutoGPT is a tool from AutoGPT Open Source. Used to enable everyone to use and build accessible AI. An information disclosure vulnerability exists in versions of AutoGPT prior to 0.6.1 that stems from the presence of cross-domain cookies and protected header disclosure in request redirects...

PT-2025-16279 · Autogpt · Autogpt

Name of the Vulnerable Software and Affected Versions: AutoGPT versions prior to 0.6.1 Description: The AutoGPT Platform's WebSocket API transmitted node execution updates to subscribers based on the graph id+graph version. However, there was no check prohibiting users from subscribing with anoth...

AutoGPT 访问控制错误漏洞

AutoGPT is a tool from AutoGPT Open Source. Used to make accessible AI available and buildable for everyone. An Access Control Error vulnerability exists in AutoGPT versions prior to 0.6.1 that stems from the WebSocket API not properly checking user subscription permissions, which could lead to...

AutoGPT 代码问题漏洞

AutoGPT is a tool from AutoGPT Open Source. Used to enable everyone to use and build accessible AI. A code issue vulnerability exists in versions of AutoGPT prior to 0.6.1 that stems from a DNS rebinding issue in the request wrapper, which could lead to server-side request forgery...

CVE-2024-10457

Multiple Server-Side Request Forgery SSRF vulnerabilities were identified in the significant-gravitas/autogpt repository, specifically in the GitHub Integration and Web Search blocks. These vulnerabilities affect version agpt-platform-beta-v0.1.1. The issues arise when block inputs are controlled...

CVE-2025-1040

AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection SSTI that could lead to Remote Code Execution RCE. The vulnerability arises from the improper handling of user-supplied format strings in the AgentOutputBlock implementation, where malicious input is passed to t...

CVE-2024-10457

Multiple Server-Side Request Forgery SSRF vulnerabilities were identified in the significant-gravitas/autogpt repository, specifically in the GitHub Integration and Web Search blocks. These vulnerabilities affect version agpt-platform-beta-v0.1.1. The issues arise when block inputs are controlled...

CVE-2024-10457 SSRF Vulnerabilities in significant-gravitas/autogpt

Multiple Server-Side Request Forgery SSRF vulnerabilities were identified in the significant-gravitas/autogpt repository, specifically in the GitHub Integration and Web Search blocks. These vulnerabilities affect version agpt-platform-beta-v0.1.1. The issues arise when block inputs are controlled...

CVE-2024-10457 SSRF Vulnerabilities in significant-gravitas/autogpt

Multiple Server-Side Request Forgery SSRF vulnerabilities were identified in the significant-gravitas/autogpt repository, specifically in the GitHub Integration and Web Search blocks. These vulnerabilities affect version agpt-platform-beta-v0.1.1. The issues arise when block inputs are controlled...

CVE-2024-10457 SSRF Vulnerabilities in significant-gravitas/autogpt

Multiple Server-Side Request Forgery SSRF vulnerabilities were identified in the significant-gravitas/autogpt repository, specifically in the GitHub Integration and Web Search blocks. These vulnerabilities affect version agpt-platform-beta-v0.1.1. The issues arise when block inputs are controlled...

CVE-2025-0454 SSRF Check Bypass in Requests Utility in significant-gravitas/autogpt

A Server-Side Request Forgery SSRF vulnerability was identified in the Requests utility of significant-gravitas/autogpt versions prior to v0.4.0. The vulnerability arises due to a hostname confusion between the urlparse function from the urllib.parse library and the requests library. A malicious...

CVE-2025-0454 SSRF Check Bypass in Requests Utility in significant-gravitas/autogpt

A Server-Side Request Forgery SSRF vulnerability was identified in the Requests utility of significant-gravitas/autogpt versions prior to v0.4.0. The vulnerability arises due to a hostname confusion between the urlparse function from the urllib.parse library and the requests library. A malicious...

CVE-2025-1040 Server-Side Template Injection (SSTI) in significant-gravitas/autogpt

AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection SSTI that could lead to Remote Code Execution RCE. The vulnerability arises from the improper handling of user-supplied format strings in the AgentOutputBlock implementation, where malicious input is passed to t...

CVE-2025-1040 Server-Side Template Injection (SSTI) in significant-gravitas/autogpt

AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection SSTI that could lead to Remote Code Execution RCE. The vulnerability arises from the improper handling of user-supplied format strings in the AgentOutputBlock implementation, where malicious input is passed to t...