{"id":"CVE-2024-6091","kind":"vulnerability","aliases":["CVE-2024-6091","GHSA-g84q-54hf-36rg"],"related":[],"title":"AutoGPT bypass of the shell commands denylist settings","description":"A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings. The issue arises when the denylist is configured to block specific commands, such as `whoami` and `/bin/whoami`. An attacker can circumvent this restriction by executing commands with a modified path, such as `/bin/./whoami`, which is not recognized by the denylist.","summary":"AutoGPT's shell command denylist only matches exact command names such as whoami and /bin/whoami. An attacker who can make the agent run a shell command can slip past the block by writing the path as /bin/./whoami, which the denylist does not recognize.","severity":"critical","cvss":9.8,"epss":0.00819,"exploited":false,"exploited_at":null,"products":[{"name":"agpt","fixed":[],"affected":"<= 0.5.1","ecosystem":"pypi"},{"name":"agpt autogpt classic","fixed":[],"affected":"= 0.5.1","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["ai-agents","ai-tooling","autogpt","cwe-78","python","self-hosted"],"not_affected_if":["no-denylist-configured","shell-execution-disabled"],"how_to_check":"- Check the installed package version with `pip show agpt` and compare it to the affected range (<= 0.5.1).\n- Look for shell command denylist settings in the AutoGPT configuration and confirm whether any are in use.","fix":"- Upgrade the `agpt` package past `0.5.1`; the fixed version is unknown from the sources.\n- Until upgraded, disable the shell execution component or restrict the agent's commands to an allowlist instead of a denylist.","status":"open","published_at":"2024-09-11T13:15:03+00:00","first_seen_at":"2026-10-26T21:01:28+00:00","triaged_at":"2026-10-26T21:08:26+00:00","updated_at":"2026-10-26T21:20:32+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-26T21:08:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `agpt` package past `0.5.1`; the fixed version is unknown from the sources.\n- Until upgraded, disable the shell execution component or restrict the agent's commands to an allowlist instead of a denylist.","reach":"unknown","title":"AutoGPT: shell command denylist bypassed with a modified binary path","impact":"high","summary":"AutoGPT's shell command denylist only matches exact command names such as whoami and /bin/whoami. An attacker who can make the agent run a shell command can slip past the block by writing the path as /bin/./whoami, which the denylist does not recognize.","category":"ai-tooling","nicknames":[],"who_cares":["autogpt","ai-agents","python","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary shell commands on the agent host.","analyst_note":"Confirm the fixed version and whether the attacker needs prior access to the agent's input, using the GHSA page at https://github.com/advisories/GHSA-g84q-54hf-36rg.","how_to_check":"- Check the installed package version with `pip show agpt` and compare it to the affected range (<= 0.5.1).\n- Look for shell command denylist settings in the AutoGPT configuration and confirm whether any are in use.","needs_analyst":true,"not_affected_if":["shell-execution-disabled","no-denylist-configured"],"who_is_affected":"Teams running AutoGPT 0.5.1 or earlier with shell command execution enabled, where the agent can be steered by untrusted input. Deployments with shell execution disabled or no denylist configured are not exposed through this flaw; the sources do not say more.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000652,"input_tokens":3385,"output_tokens":627,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2024':10A,18A '-6091':11A,19A '-78':32B '/autogpt':86C '/bin/./whoami':73B,131C '/bin/whoami':51B,115C '0.5.1':88C '36rg':16A '54hf':15A 'agent':26B,58B 'agpt':20A,21A 'ai':25B,28B 'ai-ag':24B 'ai-tool':27B 'allow':89C 'aris':101C 'attack':53B,91C,117C 'autogpt':1A,22A,30B,37B 'block':67B,108C 'bypass':2A,93C 'circumv':119C 'classic':23A 'command':6A,40B,45B,62B,96C,110C,124C 'configur':106C 'cve':9A,17A 'cwe':31B 'denylist':7A,41B,76B,97C,104C,138C 'exact':44B 'execut':123C 'g84q':14A 'ghsa':13A 'ghsa-g84q-54hf-36rg':12A 'gravita':85C 'host':36B 'issu':100C 'make':56B 'match':43B 'modifi':127C 'name':46B 'past':65B 'path':71B,128C 'python':33B 'recogn':79B,135C 'restrict':121C 'run':59B 'self':35B 'self-host':34B 'set':8A,98C 'shell':5A,39B,61B,95C 'signific':84C 'significant-gravita':83C 'slip':64B 'specif':109C 'tool':29B 'version':87C 'vulner':81C 'whoami':49B,113C 'write':69B","nicknames":[],"mitigations":[],"who_affected":"Teams running AutoGPT 0.5.1 or earlier with shell command execution enabled, where the agent can be steered by untrusted input. Deployments with shell execution disabled or no denylist configured are not exposed through this flaw; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-09-11T13:15:03+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-g84q-54hf-36rg","url":"https://github.com/advisories/GHSA-g84q-54hf-36rg","severity":"critical","published_at":"2024-09-11T15:31:12+00:00","modified_at":"2026-10-26T20:56:17+00:00","first_seen_at":"2026-10-26T21:01:28+00:00","fetched_at":"2026-10-26T21:11:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-6091","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6091","severity":null,"published_at":"2024-09-11T13:15:03+00:00","modified_at":"2026-06-17T08:17:16+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","fetched_at":"2026-10-26T21:20:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}