Executive brief
AutoGPT, a platform for managing AI agents, is vulnerable to a denial-of-service attack through its text templating feature. An attacker can submit complex commands that overwhelm the server's processor and memory, causing the entire system to crash or stop responding. This can lead to a total service outage for all users and requires manual intervention by an administrator to restore operations.
Technical details
The Fill Text Template block in AutoGPT's backend is vulnerable to a Denial of Service (DoS) via uncontrolled resource consumption (CWE-400). While the application uses a SandboxedEnvironment to prevent unauthorized attribute access (SSTI), it fails to implement execution timeouts or computational complexity limits for Jinja2 expressions. A remote attacker with low privileges can submit computationally expensive payloads (e.g., massive exponential calculations) that exhaust CPU and memory, leading to a system hang or OOM crash. This effectively locks the execution queue for all users in multi-tenant environments. The issue is fixed in version 0.6.52 by introducing resource governance.
Affected products
- Significant-Gravitas AutoGPT >= 0.1.0, < 0.6.52
Timeline
- 2026-03-20: patched: Release of version 0.6.52
- 2026-06-23: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE published to NVD