CVE-2025-32436

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, `AddAudioToVideoBlock` will download and store the video and audio in a temporary directory without deleting before all noded are done. `StepThroughItemsBlock` can be used to iterate `MediaDurationBlock` multiple times. `StepThroughItemsBlock` does not limit the number of loops. In addition, `AddAudioToVideoBlock` does not limit the amount of disk space consumed in the current working directory and does not delete the video after outputing the result. When a malicious user chooses to screen shot many web pages, the disk space will eventually run out, causing a DoS. Version 0.6.63 patches the issue.

• CWE-400

• https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-g26x-xwc5-7p44
• https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-g26x-xwc5-7p44

Published

Jun 18, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32430XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2025-32431Traefik (pronounced traffic) is an HTTP reverse proxy and lo…9.1
• CVE-2025-32432Craft is a flexible, user-friendly CMS for creating custom d…10
• CVE-2025-32433Erlang/OTP is a set of libraries for the Erlang programming …10
• CVE-2025-32434PyTorch is a Python package that provides tensor computation…9.8
• CVE-2025-32435Hydra is a Continuous Integration service for Nix based proj…2.6
• CVE-2025-32437AutoGPT is a workflow automation platform for creating, depl…8.7
• CVE-2025-32438make-initrd-ng is a tool for copying binaries and their depe…8.8
• CVE-2025-32439pleezer is a headless Deezer Connect player. Hook scripts in…6.5
• CVE-2025-3244A vulnerability was found in SourceCodester Web-based Pharma…8.8
• CVE-2025-32440NetAlertX is a network, presence scanner and alert framework…9.8
• CVE-2025-32441Rack is a modular Ruby web server interface. Prior to versio…4.2