CVE-2025-51472

Medium CVSS: 6.5

Code Injection in AgentTemplate.eval_agent_config in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to execute arbitrary Python code via malicious values in agent template configurations such as the goal, constraints, or instruction field, which are evaluated using eval() without validation during template loading or updates.

Vendor

Superagi

Product

Superagi

CWE

CWE-77

Yayın Tarihi

2025-07-22 20:15:25

Güncelleme

2025-10-09 16:09:40

Source Identifier

cve@mitre.org

KEV Date Added

Kategoriler

CWE-77 Superagi MEDIUM Superagi 2025

Referanslar

https://github.com/TransformerOptimus/SuperAGI https://github.com/TransformerOptimus/SuperAGI/pull/1461 https://www.gecko.security/blog/cve-2025-51472

Benzer Kayıtlar

Medium

CVE-2025-51475

Arbitrary File Overwrite (AFO) in superagi.controllers.resources.upload in TransformerOptimus SuperAGI 0.0.14 allows rem…

Medium

CVE-2025-6280

A vulnerability, which was classified as critical, was found in TransformerOptimus SuperAGI up to 0.0.14. Affected is th…

High

CVE-2024-9439

SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers…

Medium

CVE-2024-9447

An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. The `/get/organisat…

High

CVE-2024-9415

A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. Th…

Medium

CVE-2024-9418

In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in…