CVE-2026-33235

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions prior to 0.6.52, the Fill Text Template block is vulnerable to a Denial of Service (DoS) attack. While the backend implements a SandboxedEnvironment to prevent unauthorized attribute access (e.g., blocking __class__), it fails to limit the computational complexity or execution time of the expressions. An attacker can input computationally expensive Python/Jinja2 expressions that consume the server's CPU and memory, leading to a complete system hang or crash. In multi-tenant or self-hosted environments, this results in a complete service outage and "noisy neighbor" effects that require manual administrative intervention to recover. This issue has been fixed in version 0.6.52.

• CWE-400

• https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.52
• https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-ppw9-h7rv-gwq9
• https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-ppw9-h7rv-gwq9

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3323An unsecured configuration interface on affected devices all…7.5
• CVE-2026-33230NLTK (Natural Language Toolkit) is a suite of open source Py…6.1
• CVE-2026-33231NLTK (Natural Language Toolkit) is a suite of open source Py…7.5
• CVE-2026-33232AutoGPT is a workflow automation platform for creating, depl…7.5
• CVE-2026-33233AutoGPT is a workflow automation platform for creating, depl…7.6
• CVE-2026-33234AutoGPT is a workflow automation platform for creating, depl…5
• CVE-2026-33236NLTK (Natural Language Toolkit) is a suite of open source Py…8.1
• CVE-2026-33237WWBN AVideo is an open source video platform. Prior to versi…5.5
• CVE-2026-33238WWBN AVideo is an open source video platform. Prior to versi…4.3
• CVE-2026-3324Zohocorp ManageEngine Log360 versions 13000 through 13013 ar…8.2
• CVE-2026-33241Salvo is a Rust web framework. Prior to version 0.89.3, Salv…7.5
• CVE-2026-33242Salvo is a Rust web framework. Versions 0.39.0 through 0.89.…7.5