CVE-2025-32423

AutoGPT, a workflow automation platform, has an XSS vulnerability in versions prior to 0.6.62 on the signup page. The application improperly trusts a URL parameter (`next`), allowing an attacker to execute malicious JavaScript in the victim's browser.

AutoGPT prior to version 0.6.63 has an issue with disk space management as `MediaDurationBlock` downloads and stores video in a temporary directory without deleting it after processing. `StepThroughItemsBlock` allows for multiple iterations of `MediaDurationBlock`, which can lead to disk space exhaustion.

AutoGPT prior to version 0.6.63 has an issue with disk space management as it does not delete video and audio files from the temporary directory. Additionally, the `StepThroughItemsBlock` does not limit the number of iterations, which can lead to disk space exhaustion.

AutoGPT is a workflow automation platform that prior to version 0.6.63 had an issue with the ScreenshotWebPageBlock storing screenshots in a temporary directory. The StepThroughItemsBlock did not limit the number of iterations, which could lead to disk space exhaustion and a DoS attack.

AutoGPT before 0.6.70 has a vulnerability in the webhook_ingress_generic route that does not verify the webhook provider, allowing bypass of signature verification and execution of a generic webhook as its owner.

In AutoGPT prior to version 0.6.59, the POST /api/blocks/{block_id}/execute endpoint executes blocks without consuming any credits, regardless of the user's balance. The credit check in the graph execution path (manager.py) is never reached when blocks are called directly via the external API, allowing unlimited free execution of all blocks.

In AutoGPT (versions 0.1.0 through 0.6.51), the SendEmailBlock accepts user-supplied smtp_server and smtp_port parameters and passes them directly to smtplib.SMTP() without IP address validation, bypassing SSRF protections. An authenticated user can perform internal network port scanning and service fingerprinting.

AutoGPT versions 0.6.34 through 0.6.51 deserialize Redis cache bytes using pickle.loads without integrity checks. An attacker who poisons a Redis key can achieve remote code execution in the backend container.

AutoGPT versions 0.4.2 through 0.6.51 are vulnerable to a DoS attack via the download_agent_file endpoint, which creates persistent temporary files for each request but fails to delete them. An unauthenticated attacker can repeatedly call this endpoint to exhaust disk space and cause system failure.

AutoGPT versions 0.6.36 through 0.6.50 are vulnerable to authenticated session hijacking via IDOR. An attacker can take over another user's session by knowing their session_id.