PT-2026-6639 · Autogpt+1 · Autogpt+1

Published 2026-02-05 · Updated 2026-02-17 · CVE-2025-32393

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AutoGPT versions prior to 0.6.32

Description AutoGPT is a platform for creating and managing AI agents that automate workflows. A denial-of-service condition exists in the ReadRSSFeedBlock component due to uncontrolled resource allocation during XML parsing with feedparser.parser. A malicious user can provide a specially crafted, deeply nested XML file via a URL, leading to excessive memory consumption and ultimately a denial-of-service. The vulnerable component calls feedparser.parser to obtain and parse XML files based on user-provided URLs. There is no limit on parsing time or resource allocation during this process.

Recommendations Update to version 0.6.32 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-32393

GHSA-5CQW-G779-9F9X

Affected Products

Autogpt

Feedparser

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32393.json · Exploit
• https://github.com/Significant-Gravitas/AutoGPT/commit/57a06f70883ce6be18738c6ae8bb41085c71e266 · Patch
• https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-5cqw-g779-9f9x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32393 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32393 · Vendor Advisory
• https://twitter.com/CVEnew/status/2019552258392985609 · Twitter Post
• https://t.me/cveNotify/152199 · Telegram Post
• https://t.me/cveNotify/151064 · Telegram Post
• https://t.me/CVEtracker/43872 · Telegram Post