High severity · published Mar 20, 2025
CVE-2025-1040
AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote Code Execution (RCE)
8.8
CVSS
1.7%
EPSS
No
On KEV
Description
AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote Code Execution (RCE). The vulnerability arises from the improper handling of user-supplied format strings in the `AgentOutputBlock` implementation, where malicious input is passed to the Jinja2 templating engine without adequate security measures. Attackers can exploit this flaw to execute arbitrary commands on the host system. The issue is fixed in version 0.4.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Autogpt Platform · Agpt
before 0.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1040
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1040
Patch
https://github.com/significant-gravitas/autogpt/commit/6dba31e0215549604bdcc1aed24e3a1714e75ee2
Exploit
https://huntr.com/bounties/b74ef75f-61d5-4422-ab15-9550c8b4f185
More from Autogpt Platform
9.8
CVE-2025-62616
AutoGPT has SSRF vulnerability in SendDiscordFileBlock
9.8
CVE-2025-62615
AutoGPT has SSRF vulnerability in ReadRSSFeedBlock
8.8
CVE-2026-26020
AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__)
8.8
CVE-2026-24780
AutoGPT is Vulnerable to RCE via Disabled Block Execution
8.6
CVE-2025-31491
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows