Pwuts

**Name of the Vulnerable Software and Affected Versions** AutoGPT versions prior to 0.6.1 **Description** The AutoGPT Platform's WebSocket API transmitted node execution updates to subscribers based on the `graph id`+`graph version`. However, there was no check prohibiting users from subscribing with another user's `graph id`+`graph version`. As a result, node execution updates from one user's graph execution could be received by another user within the same instance. This issue does not occur between different instances or between users and non-users of the platform. Single-user instances are not affected. In private instances with a user white-list, the impact is limited by the fact that all potential unintended recipients of these node execution updates must have been admitted by the administrator. **Recommendations** For versions prior to 0.6.1, update to version 0.6.1 to resolve the issue. As a temporary workaround, consider restricting access to the WebSocket API or limiting subscriptions to only trusted users within the same instance. Additionally, in private instances with a user white-list, ensure that only authorized users are admitted by the administrator to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Auto-GPT versions prior to 0.4.3 **Description** The issue arises from the use of a different docker-compose.yml file when running Auto-GPT by cloning the git repo and executing `docker compose run auto-gpt` in the repo root. This file mounts itself into the docker container without write protection, allowing malicious custom python code executed via the `execute python file` and `execute python code` commands to overwrite the docker-compose.yml file. This can lead to abuse and gain control of the host system the next time Auto-GPT is started. **Recommendations** For versions prior to 0.4.3, update to version 0.4.3 to resolve the issue. As a temporary workaround, consider disabling the `execute python file` and `execute python code` commands until the update is applied. Restrict access to the docker-compose.yml file to minimize the risk of exploitation.