CVE-2024-1879

A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT server. The vulnerability stems from the lack of protections on the API endpoint receiving instructions, enabling an attacker to direct a user running AutoGPT in their local network to a malicious website. This site can then send crafted requests to the AutoGPT server, leading to command execution. The issue is exacerbated by CORS being enabled for arbitrary origins by default, allowing the attacker to read the response of all cross-site queries. This vulnerability was addressed in version 5.1.

• CWE-352

• https://github.com/significant-gravitas/autogpt/commit/26324f29849967fa72c207da929af612f1740669Patch
• https://huntr.com/bounties/125c2d0c-0481-4e5c-ae90-fec263acdf32Exploit, Third Party Advisory
• https://github.com/significant-gravitas/autogpt/commit/26324f29849967fa72c207da929af612f1740669Patch
• https://huntr.com/bounties/125c2d0c-0481-4e5c-ae90-fec263acdf32Exploit, Third Party Advisory

Published

Jun 6, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-1873parisneo/lollms-webui is vulnerable to path traversal and de…9.1
• CVE-2024-1874In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.…9.4
• CVE-2024-1875A vulnerability was found in SourceCodester Complaint Manage…8.8
• CVE-2024-1876A vulnerability was found in SourceCodester Employee Managem…9.8
• CVE-2024-1877A vulnerability was found in SourceCodester Employee Managem…8.8
• CVE-2024-1878A vulnerability was found in SourceCodester Employee Managem…8.8
• CVE-2024-1880An OS command injection vulnerability exists in the MacOS Te…7.8
• CVE-2024-1881AutoGPT, a component of significant-gravitas/autogpt, is vul…9.8
• CVE-2024-1882This vulnerability allows an already authenticated admin use…7.2
• CVE-2024-1883This is a reflected cross site scripting vulnerability in th…6.1
• CVE-2024-1884This is a Server-Side Request Forgery (SSRF) vulnerability i…6.5
• CVE-2024-1885This vulnerability allows remote attackers to execute arbitr…9.8