CVE-2026-55237
HighCVSS 8.8Summary
AutoGPT, a workflow automation platform, has an XSS vulnerability in versions prior to 0.6.62 on the signup page. The application improperly trusts a URL parameter (`next`), allowing an attacker to execute malicious JavaScript in the victim's browser.
Risk Assessment
This vulnerability could lead to credential theft and unauthorized actions performed on behalf of the victim, posing a serious security risk to the organization.
Recommendation
It is recommended to upgrade to version 0.6.62 or later to mitigate this vulnerability and to review and validate the URL parameters used.
Original NVD description (English source)
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions prior to 0.6.62 have a DOM-based Cross-Site Scripting (XSS) vulnerability in AutoGPT's signup page. The application improperly trusts a URL parameter (`next`), which is passed to `router.push`. An attacker can craft a malicious link that, when opened by an authenticated user, performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. Version 0.6.62 patches the issue.