CVE-2024-9439CWE-94

Remote Code Execution in transformeroptimus/superagi

High · published March 20, 2025

CVSS v3.0
8.8
EPSS
1%
Percentile
68.6
In the wild
Unconfirmed
What it is

SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01224 · 68.6th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-03-20T10:10Z
EPSS history
Timeline
  • 20 MAR 10:10Z
    Remote Code Execution in transformeroptimus/superagi
    cvelistv5