CVE-2024-1879

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT server. The vulnerability stems from the lack of protections on the API endpoint receiving instructions, enabling an attacker to direct a user running AutoGPT in their local network to a malicious website. This site can then send crafted requests to the AutoGPT server, leading to command execution. The issue is exacerbated by CORS being enabled for arbitrary origins by default, allowing the attacker to read the response of all cross-site queries. This vulnerability was addressed in version 5.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jun 6, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-18807.8An OS command injection vulnerability exists in the MacOS Text-To-Speech class MacOSTTS of the significant-gravitas/autogpt project, affecti CVE-2024-18819.8AutoGPT, a component of significant-gravitas/autogpt, is vulnerable to an improper neutralization of special elements used in an OS command CVE-2024-18827.2This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code executio CVE-2024-18836.1This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. An attacker can exploit this weakness by cr CVE-2024-18846.5This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the s CVE-2024-18859.8This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage.CVE-2024-18868.8This vulnerability allows remote attackers to traverse the directory on the affected webOS of LG Signage.CVE-2024-18874.3Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the CVE-2024-18884.3Mattermost fails to check the "invite_guest" permission when inviting guests of other teams to a team, allowing a member with permissions to CVE-2024-18898.8Cross-Site Request Forgery vulnerability in SMA Cluster Controller, affecting version 01.05.01.R. This vulnerability could allow an attacker CVE-2024-18905.4Vulnerability whereby an attacker could send a malicious link to an authenticated operator, which could allow remote attackers to perform a CVE-2024-18915.4A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code