CVE-2024-6091
CVE-2024-6091 · Shell Command Denylist Bypass in significant-gravitas/autogpt
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings. The issue arises when the denylist is configured to block specific commands, such as 'whoami' and '/bin/whoami'. An attacker can circumvent this restriction by executing commands with a modified path, such as '/bin/./whoami', which is not recognized by the denylist.
CVSS 9.8 · Critique · EPSS 0,8% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: python
Produits et versions concernés
significant-gravitas/autogpt
- Versions du logiciel
- ≥ unspecified, < 0.5.1: Concernée (custom)
Mettez à jour vers 0.5.1
agpt PyPI
- Versions du logiciel
- 0.2.2
- Plages de versions concernées
- ECOSYSTEM: ≤ 0.5.1
Aucun correctif publié