CVE-2024-21552 | THREATINT

Assigner	snyk
Reserved	2023-12-22
Published	2024-07-22
Updated	2024-08-01

Description

All versions of `SuperAGI` are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the LLM output to exploit this vulnerability and gain arbitrary code execution on the SuperAGI application server.

CRITICAL: 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

Arbitrary Code Execution

Credits

Rory McNamara (Snyk Security Research)

References

https://github.com/TransformerOptimus/SuperAGI/blob/9361f0491716e56bd0c0ae2f3b49da201a18c58c/superagi/agent/output_handler.py#L149

https://github.com/TransformerOptimus/SuperAGI/blob/9361f0491716e56bd0c0ae2f3b49da201a18c58c/superagi/agent/output_handler.py#L180

cve.org CVE-2024-21552

nvd.nist.gov CVE-2024-21552

Download JSON