CVE-2024-21552: Code Injection
Published Jul 22, 2024
·Updated
All versions of SuperAGI are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the LLM output to exploit this vulnerability and gain arbitrary code execution on the SuperAGI application server.
Affected Software
1 affected component
superagi SuperAGI<=
Event History
Jul 22, 2024
CVE Published
via MITRE·02:18 PM
Data Sourced
via MITRE·02:18 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-21552?
CVE-2024-21552 is considered a high severity vulnerability due to its potential for arbitrary code execution.
2
How do I fix CVE-2024-21552?
To fix CVE-2024-21552, avoid using the 'eval' function in the SuperAGI application and implement safer alternatives for processing data.
3
Which versions of SuperAGI are affected by CVE-2024-21552?
All versions of SuperAGI are affected by CVE-2024-21552.
4
What type of vulnerability is CVE-2024-21552?
CVE-2024-21552 is classified as an Arbitrary Code Execution vulnerability.
5
Can an attacker exploit CVE-2024-21552 remotely?
Yes, an attacker can exploit CVE-2024-21552 remotely by inducing the LLM output.