CVE-2024-6091
CVE-2024-6091 · Shell Command Denylist Bypass in significant-gravitas/autogpt
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings. The issue arises when the denylist is configured to block specific commands, such as 'whoami' and '/bin/whoami'. An attacker can circumvent this restriction by executing commands with a modified path, such as '/bin/./whoami', which is not recognized by the denylist.
CVSS 9.8 · Critical · EPSS 0.8% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
significant-gravitas/autogpt
- Versions
- ≥ unspecified, < 0.5.1: Affected (custom)
Update to 0.5.1
agpt PyPI
- Versions
- 0.2.2
- Affected ranges
- ECOSYSTEM: ≤ 0.5.1
No fix published