PT-2025-30457 · Unknown · Transformeroptimus/Superagi

Geckosecurity · Published 2025-07-22 · Updated 2025-07-22 · CVE-2025-51472

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TransformerOptimus SuperAGI version 0.0.14

Description A code injection issue exists in AgentTemplate.eval agent config within TransformerOptimus SuperAGI version 0.0.14. This allows remote attackers to execute arbitrary Python code by providing malicious values in agent template configurations, specifically within the goal, constraints, or instruction fields. The eval() function is used without validation during template loading or updates, enabling the execution of injected code.

Recommendations Update to a newer version of TransformerOptimus SuperAGI that addresses this issue. As a temporary workaround, avoid using untrusted or user-supplied input for the goal, constraints, or instruction fields in agent template configurations.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-51472

Affected Products

Transformeroptimus/Superagi

References · 5

• 🔥 https://github.com/TransformerOptimus/SuperAGI/pull/1461 · Exploit
• 🔥 https://gecko.security/blog/cve-2025-51472 · Exploit
• https://osv.dev/vulnerability/CVE-2025-51472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-51472 · Security Note
• https://github.com/TransformerOptimus/SuperAGI · Note