PT-2025-12316 · Significant Gravitas+1 · Autogpt+2

Published 2025-03-20 · Updated 2025-08-05 · CVE-2025-0454

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions significant-gravitas/autogpt versions prior to v0.4.0

Description A Server-Side Request Forgery (SSRF) issue was identified, arising from a hostname confusion between the urlparse function from the urllib.parse library and the requests library. This can be exploited by a malicious user submitting a specially crafted URL, such as http://localhost:@google.com/../, to bypass the SSRF check and perform an SSRF attack.

Recommendations For versions prior to v0.4.0, update to version v0.4.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the urlparse function and the requests library to minimize the risk of exploitation. Avoid using specially crafted URLs in the affected utility until the issue is resolved.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-0454

Affected Products

Autogpt

Requests

Urllib.Parse

References · 9

• 🔥 https://huntr.com/bounties/0664fdee-bdc2-4650-8075-74d7b8d3e308 · Exploit
• https://github.com/significant-gravitas/autogpt/commit/ff065cd24c2289878c0abdb9adbf91c305f0d70a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-0454 · Security Note
• https://osv.dev/vulnerability/CVE-2025-0454 · Vendor Advisory
• https://t.me/cvetracker/19522 · Telegram Post
• https://t.me/cveNotify/130957 · Telegram Post
• https://t.me/cveNotify/130533 · Telegram Post
• https://twitter.com/CVEnew/status/1902670978364432525 · Twitter Post
• https://t.me/cvedetector/20716 · Telegram Post