Live › vulnerability › CVE-2024-6091
Go to dashboardAutoGPT's shell command denylist only matches exact command names such as whoami and /bin/whoami. An attacker who can make the agent run a shell command can slip past the block by writing the path as /bin/./whoami, which the denylist does not recognize.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:01 UTC, 0h before NVD. All times on this page are UTC.
Teams running AutoGPT 0.5.1 or earlier with shell command execution enabled, where the agent can be steered by untrusted input. Deployments with shell execution disabled or no denylist configured are not exposed through this flaw; the sources do not say more.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| agpt | pypi | <= 0.5.1 | – |
| agpt autogpt classic | vendor | = 0.5.1 | – |
pip show agpt and compare it to the affected range (<= 0.5.1).agpt package past 0.5.1; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings. The issue arises when the denylist is configured to block specific commands, such as whoami and /bin/whoami. An attacker can circumvent this restriction by executing commands with a modified path, such as /bin/./whoami, which is not recognized by the denylist.
This page as .md · .json · in your agent: get_signal("CVE-2024-6091")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.