CVE-2024-8156: Command Injection in significant-gravitas/autogpt
A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt. The untrusted user input github.head.ref is used insecurely, allowing an attacker to inject arbitrary commands. This vulnerability affects versions up to and including the latest version. An attacker can exploit this by creating a branch name with a malicious payload and opening a pull request, potentially leading to reverse shell access or theft of sensitive tokens and keys.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8156?
CVE-2024-8156 is classified as a high severity command injection vulnerability.
How do I fix CVE-2024-8156?
To fix CVE-2024-8156, validate and sanitize the input from `github.head.ref` before processing it.
Who is affected by CVE-2024-8156?
CVE-2024-8156 affects all versions of Significant Gravitas Autogpt up to and including the latest.
What type of vulnerability is CVE-2024-8156?
CVE-2024-8156 is a command injection vulnerability that allows for arbitrary command execution.
What is the impact of exploiting CVE-2024-8156?
Exploiting CVE-2024-8156 can allow an attacker to execute arbitrary commands in the context of the application.