CVE-2025-1040
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Mar 20, 2025
Updated: Apr 1, 2025
CWE ID 77
Summary
CVE-2025-1040 is a Server-Side Template Injection (SSTI) vulnerability affecting AutoGPT versions 0.3.4 and earlier. This issue stems from the mishandling of user-supplied format strings within the `AgentOutputBlock` implementation, which in turn exposes the system to Remote Code Execution (RCE) attacks. Malicious inputs passed to the Jinja2 templating engine go unchecked, enabling attackers to inject and execute arbitrary commands on the host system. Version 0.4.0 of AutoGPT incorporates necessary security measures to mitigate this threat.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.