CVE-2025-0454: SSRF Check Bypass in Requests Utility in significant-gravitas/autogpt
A Server-Side Request Forgery (SSRF) vulnerability was identified in the Requests utility of significant-gravitas/autogpt versions prior to v0.4.0. The vulnerability arises due to a hostname confusion between the urlparse function from the urllib.parse library and the requests library. A malicious user can exploit this by submitting a specially crafted URL, such as http://localhost:\@google.com/../, to bypass the SSRF check and perform an SSRF attack.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0454?
CVE-2025-0454 has been categorized as a medium severity vulnerability due to its potential for exploitation in Server-Side Request Forgery attacks.
How do I fix CVE-2025-0454?
To fix CVE-2025-0454, update the significant-gravitas/autogpt package to version 0.4.0 or later.
What software is affected by CVE-2025-0454?
CVE-2025-0454 affects significant-gravitas/autogpt versions prior to 0.4.0.
What type of attack does CVE-2025-0454 enable?
CVE-2025-0454 allows for Server-Side Request Forgery (SSRF) attacks, potentially leading to unauthorized access to internal resources.
Can I still use earlier versions of significant-gravitas/autogpt after CVE-2025-0454 is disclosed?
It is strongly advised to avoid using earlier versions of significant-gravitas/autogpt since they are vulnerable to CVE-2025-0454.