CVE-2025-1040
📋 TL;DR
AutoGPT versions 0.3.4 and earlier contain a Server-Side Template Injection vulnerability that allows attackers to execute arbitrary code on the host system. This affects all users running vulnerable versions of AutoGPT, particularly those exposing the application to untrusted users.
💻 Affected Systems
- AutoGPT
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the host, data exfiltration, and lateral movement within the network.
Likely Case
Remote code execution leading to data theft, installation of malware, or use of the system as a foothold for further attacks.
If Mitigated
Limited impact with proper network segmentation and access controls, potentially only affecting the AutoGPT application container.
🎯 Exploit Status
Exploitation requires understanding of SSTI techniques and Jinja2 templating, but no authentication is needed once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.4.0
Vendor Advisory: https://github.com/significant-gravitas/autogpt/commit/6dba31e0215549604bdcc1aed24e3a1714e75ee2
Restart Required: No
Instructions:
1. Stop AutoGPT service. 2. Update to version 0.4.0 using pip: 'pip install --upgrade autogpt==0.4.0'. 3. Restart AutoGPT service.
🔧 Temporary Workarounds
Disable Jinja2 template processing
allModify configuration to disable or restrict template processing in AgentOutputBlock
🧯 If You Can't Patch
- Network segmentation: Isolate AutoGPT instances from critical systems
- Implement strict input validation and sanitization for all user-supplied format strings
🔍 How to Verify
Check if Vulnerable:
Check AutoGPT version: if version <= 0.3.4, system is vulnerableCheck Version:
python -c "import autogpt; print(autogpt.__version__)"Verify Fix Applied:
Confirm version is 0.4.0 or higher and test template injection attempts are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual template rendering errors
- Suspicious Jinja2 template patterns in logs
- Unexpected system command execution
Network Indicators:
- Unusual outbound connections from AutoGPT host
- Command and control traffic patterns
SIEM Query:
source="autogpt.log" AND ("template injection" OR "jinja2" OR "{{.*}}")