CVE-2024-10457

Multiple Server-Side Request Forgery (SSRF) vulnerabilities were identified in the significant-gravitas/autogpt repository, specifically in the GitHub Integration and Web Search blocks. These vulnerabilities affect version agpt-platform-beta-v0.1.1. The issues arise when block inputs are controlled by untrusted sources, leading to potential credential leakage, internal network scanning, and unauthorized access to internal services, APIs, or data stores. The affected blocks include GithubListPullRequestsBlock, GithubReadPullRequestBlock, GithubAssignPRReviewerBlock, GithubListPRReviewersBlock, GithubUnassignPRReviewerBlock, GithubCommentBlock, GithubMakeIssueBlock, GithubReadIssueBlock, GithubListIssuesBlock, GithubAddLabelBlock, GithubRemoveLabelBlock, GithubListBranchesBlock, and ExtractWebsiteContentBlock.

• CWE-918

• https://github.com/significant-gravitas/autogpt/commit/bcaf3241dadfc1fca024e91fb8f2e3004105a172
• https://huntr.com/bounties/1d91e1e1-7d45-4bda-bc27-bfe9052fd975

Published

Mar 20, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-10451A flaw was found in Keycloak. This issue occurs because sens…5.9
• CVE-2024-10452Organization admins can delete pending invites created in an…2.7
• CVE-2024-10453The Elementor Website Builder – More than Just a Page Builde…5.4
• CVE-2024-10454Clickjacking vulnerability in Clibo Manager v1.1.9.12 in the…6.1
• CVE-2024-10455Reachable Assertion in BPv7 parser in µD3TN v0.14.0 allows a…7.5
• CVE-2024-10456Delta Electronics InfraSuite Device Master versions prior to…9.8
• CVE-2024-10458A permission leak could have occurred from a trusted site to…7.5
• CVE-2024-10459An attacker could have caused a use-after-free when accessib…7.5
• CVE-2024-1046The Paid Membership Plugin, Ecommerce, User Registration For…5.4
• CVE-2024-10460The origin of an external protocol handler prompt could have…5.3
• CVE-2024-10461In multipart/x-mixed-replace responses, `Content-Disposition…6.1
• CVE-2024-10462Truncation of a long URL could have allowed origin spoofing …6.5