CVE-2025-32437: AutoGPT has a DoS vulnerability in MediaDurationBlock
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, MediaDurationBlock will download and store the video in a temporary directory without deleting before all noded are done. StepThroughItemsBlock can be used to iterate MediaDurationBlock multiple times. StepThroughItemsBlock does not limit the number of loops. In addition, MediaDurationBlock does not limit the amount of disk space consumed in the current working directory and does not delete the video after outputing the result. When a malicious user chooses to screen shot many web pages, the disk space will eventually run out, causing a DoS. Version 0.6.63 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AutoGPTto a version that resolves this vulnerability.Fixed in 0.6.63 - Remove
Remove
AutoGPT/MediaDurationBlockfrom your environment.If MediaDurationBlock is not required, disable or uninstall the MediaDurationBlock component to eliminate the vulnerable functionality.
- Compensating control
Enforce disk quotas or limit writable storage for the AutoGPT working/temporary directories to prevent full-disk denial-of-service from unbounded media downloads.
- Operational
Locate and delete accumulated temporary video files produced by MediaDurationBlock and put in place periodic cleanup or monitoring of disk usage for AutoGPT working and temporary directories.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32437?
CVE-2025-32437 has a high severity rating of 8.7.
How do I fix CVE-2025-32437?
To fix CVE-2025-32437, update AutoGPT to version 0.6.63 or later.
What is the main issue of CVE-2025-32437?
CVE-2025-32437 is a DoS vulnerability in the MediaDurationBlock that does not properly manage temporary video files.
Can CVE-2025-32437 be exploited remotely?
Yes, CVE-2025-32437 can be exploited remotely due to its nature of not requiring authentication.
What software is affected by CVE-2025-32437?
CVE-2025-32437 affects AutoGPT prior to version 0.6.63.