CVE-2025-51472: Code Injection
Code Injection in AgentTemplate.evalagentconfig in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to execute arbitrary Python code via malicious values in agent template configurations such as the goal, constraints, or instruction field, which are evaluated using eval() without validation during template loading or updates.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-51472?
CVE-2025-51472 is classified as a high severity vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2025-51472?
To fix CVE-2025-51472, validate and sanitize all input values in agent template configurations before evaluating them.
What software is affected by CVE-2025-51472?
CVE-2025-51472 affects the TransformerOptimus SuperAGI version 0.0.14.
What kind of attack does CVE-2025-51472 enable?
CVE-2025-51472 enables remote attackers to execute arbitrary Python code due to improper validation in agent configurations.
Can I check if my system is vulnerable to CVE-2025-51472?
You can check for CVE-2025-51472 vulnerability by verifying if you are using TransformerOptimus SuperAGI version 0.0.14 and assessing your agent template configurations.