CVE-2024-9439
Last modified
CVE-2024-9439 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. EPSS estimates a 1.09% chance of exploitation in the next 30 days.
Description
SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.
Metrics
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Superagi | Superagi | 0.0.14 |
References
- https://huntr.com/bounties/d710884f-b5ab-4b31-a2e6-e4b38488def1Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-9439?
How severe is CVE-2024-9439?
How do I fix CVE-2024-9439?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-9432Cleartext Storage of Sensitive Information vulnerability in …6.9
- CVE-2024-9434The WPGlobus Translate Options plugin for WordPress is vulne…6.1
- CVE-2024-9435The ShiftController Employee Shift Scheduling plugin for Wor…6.1
- CVE-2024-9436The PublishPress Revisions: Duplicate Posts, Submit, Approve…6.1
- CVE-2024-9437SuperAGI version v0.0.14 is vulnerable to an unauthenticated…7.5
- CVE-2024-9438The SEUR Oficial plugin for WordPress is vulnerable to Refle…6.1
- CVE-2024-9440Slim Select 2.0 versions through 2.9.0 are affected by a pot…6.1
- CVE-2024-9441The Linear eMerge e3-Series through version 1.00-07 is vulne…9.8
- CVE-2024-9442The F4 Improvements plugin for WordPress is vulnerable to St…5.4
- CVE-2024-9443The Basticom Framework plugin for WordPress is vulnerable to…5.4
- CVE-2024-9444The ElementsReady Addons for Elementor plugin for WordPress …5.4
- CVE-2024-9445The Display Medium Posts plugin for WordPress is vulnerable …5.4
Are you affected by CVE-2024-9439?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST